Edit tour

Windows Analysis Report
badger_x64_stealth_rtl.bin.dll.dll

Overview

General Information

Sample name:	badger_x64_stealth_rtl.bin.dll.dll (renamed file extension from exe to dll)
Original sample name:	badger_x64_stealth_rtl.bin.dll.exe
Analysis ID:	1637286
MD5:	decf7b259d75e0e499f44c5a915b3175
SHA1:	af87c4222d4538fd4d43eaa0cb30974af08ea21e
SHA256:	ba847f3edf4f9c540641c30f45e40baee8287d30d5aef59543d24f0375140f27
Tags:	bazaarloaderbruteratelexeuser-cedricgmirror2
Infos:

Detection

BruteRatel

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected BruteRatel

Contains functionality to inject threads in other processes

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Modifies the context of a thread in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Sigma detected: CobaltStrike Load by Rundll32

Uses known network protocols on non-standard ports

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query network adapater information

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 8008 cmdline: loaddll64.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 8016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8060 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 8084 cmdline: rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8068 cmdline: rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,DllMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8156 cmdline: rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7580 cmdline: rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",DllMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7596 cmdline: rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",StartW MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.eclecticiq.com/inside-intelligence-center-lunar-spider-enabling-ransomware-attacks-on-financial-sector-with-brute-ratel-c4-and-latrodectus https://blog.krakz.fr/articles/latrodectus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_2	Yara detected BruteRatel	Joe Security
00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: loaddll64.exe PID: 8008	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: rundll32.exe PID: 8156	JoeSecurity_BruteRatel_2	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 8156	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: rundll32.exe PID: 7596	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: CobaltStrike Load by Rundll32

Source: Process started

Author: Wojciech Lesicki: Data: Command: rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW, CommandLine: rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: loaddll64.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll", ParentImage: C:\Windows\System32\loaddll64.exe, ParentProcessId: 8008, ParentProcessName: loaddll64.exe, ProcessCommandLine: rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW, ProcessId: 8156, ProcessName: rundll32.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: badger_x64_stealth_rtl.bin.dll.dll

Avira: detected

Antivirus detection for URL or domain

Source: https://tiguanin.com:8041/A	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php$	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/admin.phpx	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.phpgU	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.phpl	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.phpD	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php&	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php.muip	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.phpf	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php/	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/:	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/5	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.phpF	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/=	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.phpU	Avira URL Cloud: Label: malware
Source: https://tiguanin.com/b	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.phpg	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.phpk	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/1	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/U	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.phpt	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.php	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/%	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpJ=	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/I	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/dmin.php	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php.mui	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/&	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.phpem32	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.phpf	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/q	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/a	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.phpR	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpx	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/Y	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/5	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/in.com:8041/.	Avira URL Cloud: Label: malware
Source: https://greshunka.com/	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/azar.php	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.phpD	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.php6	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.php~=	Avira URL Cloud: Label: malware
Source: https://greshunka.com/5:	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpm:8041/bazar.php	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.php	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.php7	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpf	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/admin.php;	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpe	Avira URL Cloud: Label: malware
Source: https://tiguanin.com/V=6	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/I	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.php;	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpi	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.php0	Avira URL Cloud: Label: malware
Source: https://bazarunet.com/	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phph	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/admin.phpA	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpl	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/azar.php	Avira URL Cloud: Label: malware
Source: https://tiguanin.com/	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.phpqU	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/AppData	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/admin.phpD=	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.phpD=	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.php/	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.php:=R	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/bazar.php	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/nka.com:8041/admin.php	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.phpl	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/in.com:8041/	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.phpJ	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.php)	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.phpH	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/5	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/azar.php.	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.phpe	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/nk	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/admin.php2	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/admin.php	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/p	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/bazar.php;	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/admin.phpV=6	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.phpX	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/nka.com:8041/	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/admin.php	Avira URL Cloud: Label: malware
Source: https://greshunka.com:8041/	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/nka.com:8041/	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/in.com:8041/.	Avira URL Cloud: Label: malware
Source: https://tiguanin.com:8041/bazar.phpR	Avira URL Cloud: Label: malware
Source: https://bazarunet.com:8041/AppData	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: badger_x64_stealth_rtl.bin.dll.dll	Virustotal: Detection: 79%			Perma Link
Source: badger_x64_stealth_rtl.bin.dll.dll	ReversingLabs: Detection: 76%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: badger_x64_stealth_rtl.bin.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: kernel32.pdbUGP source: loaddll64.exe, 00000000.00000002.1220566576.000002321C680000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1199622220.0000022FC0C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1222841274.0000026626051000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: loaddll64.exe, 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: loaddll64.exe, 00000000.00000003.1218432026.000002321C685000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.1158677259.000002632B8A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1158383010.000001337AB98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188400593.0000022FC0C2E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1218675221.0000028957EB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1218727097.0000026626055000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: loaddll64.exe, 00000000.00000003.1218432026.000002321C685000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.1158677259.000002632B8A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1158383010.000001337AB98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188400593.0000022FC0C2E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1218675221.0000028957EB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1218727097.0000026626055000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: loaddll64.exe, 00000000.00000002.1220566576.000002321C680000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1199622220.0000022FC0C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1222841274.0000026626051000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: loaddll64.exe, 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 82.115.223.39 8041			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 80.78.24.30 8041			Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49885

Source: global traffic	TCP traffic: 192.168.2.4:49724 -> 80.78.24.30:8041
Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 82.115.223.39:8041

Source: Joe Sandbox View	IP Address: 82.115.223.39 82.115.223.39
Source: Joe Sandbox View	IP Address: 80.78.24.30 80.78.24.30
Source: Joe Sandbox View	IP Address: 80.78.24.30 80.78.24.30

Source: Joe Sandbox View	ASN Name: MIDNET-ASTK-TelecomRU MIDNET-ASTK-TelecomRU
Source: Joe Sandbox View	ASN Name: CYBERDYNELR CYBERDYNELR

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: tiguanin.com
Source: global traffic	DNS traffic detected: DNS query: bazarunet.com
Source: global traffic	DNS traffic detected: DNS query: greshunka.com

Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1358846480.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com/
Source: rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/
Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/5
Source: rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/AppData
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/I
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/Y
Source: rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407235703.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1398680355.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php6
Source: rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.php:=R
Source: rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpD=
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpF
Source: rundll32.exe, 00000005.00000003.1407276530.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpe
Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpem32
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/admin.phpl
Source: rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1358833561.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1360003153.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1353770640.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390355797.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php
Source: rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php0
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php7
Source: rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php;
Source: rundll32.exe, 00000005.00000003.1358833561.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpD
Source: rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpR
Source: rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpg
Source: rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.phpk
Source: rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/bazar.php~=
Source: rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/dmin.php
Source: rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/nka.com:8041/
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bazarunet.com:8041/q
Source: rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com/
Source: rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com/5:
Source: rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/
Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/%
Source: rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/&
Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/1
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/5
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/a
Source: rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.php
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.php;
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpA
Source: rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpD=
Source: rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpV=6
Source: rundll32.exe, 00000008.00000002.2421895839.00000266246B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/admin.phpx
Source: rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/azar.php
Source: rundll32.exe, 00000008.00000003.1327035826.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php$
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php&
Source: rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php.mui
Source: rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php.muip
Source: rundll32.exe, 00000005.00000003.1292025266.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1275952668.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1322539060.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php/
Source: rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.php;
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpJ
Source: rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpJ=
Source: rundll32.exe, 00000005.00000003.1392321407.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpe
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpf
Source: rundll32.exe, 00000008.00000003.1672357732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phph
Source: rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpi
Source: rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpl
Source: rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpm:8041/bazar.php
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/bazar.phpx
Source: rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/in.com:8041/.
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/nk
Source: rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greshunka.com:8041/nka.com:8041/admin.php
Source: rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com/
Source: rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com/V=6
Source: rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1256467181.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com/b
Source: rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/
Source: rundll32.exe, 00000005.00000003.1346012770.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/5
Source: rundll32.exe, 00000005.00000003.1256467181.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/:
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/=
Source: rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/A
Source: rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1256467181.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/AppData
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/I
Source: rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/U
Source: rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1704975885.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.php
Source: rundll32.exe, 00000005.00000003.1345981976.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.php)
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.php2
Source: rundll32.exe, 00000005.00000003.1345981976.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.phpD
Source: rundll32.exe, 00000008.00000003.1456138536.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1396754431.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1403153176.0000026626089000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.phpU
Source: rundll32.exe, 00000008.00000003.1456138536.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1396754431.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1403153176.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1867333603.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.phpf
Source: rundll32.exe, 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.phpgU
Source: rundll32.exe, 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/admin.phpqU
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/azar.php
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/azar.php.
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1867333603.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1672357732.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1535482489.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1542184485.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1704975885.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.php
Source: rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1556192704.0000022FC0C5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2037529076.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1982872875.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1957812418.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1613791133.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.php/
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpF
Source: rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpH
Source: rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpR
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpX
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1867333603.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1672357732.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1535482489.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1542184485.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1704975885.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpf
Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpl
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/bazar.phpt
Source: rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/in.com:8041/
Source: rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/in.com:8041/.
Source: rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/nka.com:8041/
Source: rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiguanin.com:8041/p

Source: loaddll64.exe, 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_a5d7b8df-8

Source: loaddll64.exe, 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_3525e09e-6

Source: Yara match	File source: 00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 8156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7596, type: MEMORYSTR

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000002321C5DDA6E NtProtectVirtualMemory,	0_2_000002321C5DDA6E
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000002321C5DD9FE NtOpenFile,	0_2_000002321C5DD9FE
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000002321C5DDACE NtReadFile,	0_2_000002321C5DDACE
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000026329F3D9FE NtOpenFile,	3_2_0000026329F3D9FE
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000026329F3DACE NtReadFile,	3_2_0000026329F3DACE
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001337939D9FE NtOpenFile,	4_2_000001337939D9FE
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001337939DA6E NtProtectVirtualMemory,	4_2_000001337939DA6E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001337939DACE NtReadFile,	4_2_000001337939DACE
Source: C:\Windows\System32\rundll32.exe	Code function: 5_3_0000022FBF31D98E NtAllocateVirtualMemory,	5_3_0000022FBF31D98E
Source: C:\Windows\System32\rundll32.exe	Code function: 5_3_0000022FBF31DA6E NtProtectVirtualMemory,	5_3_0000022FBF31DA6E
Source: C:\Windows\System32\rundll32.exe	Code function: 5_3_0000022FBF31DACE NtReadFile,	5_3_0000022FBF31DACE
Source: C:\Windows\System32\rundll32.exe	Code function: 5_3_0000022FBF31D9FE NtOpenFile,	5_3_0000022FBF31D9FE
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D38149 NtSetContextThread,	5_2_0000022FC0D38149
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D545F0 NtDuplicateObject,	5_2_0000022FC0D545F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D355C0 NtClose,NtTerminateThread,	5_2_0000022FC0D355C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D551C0 NtReadVirtualMemory,	5_2_0000022FC0D551C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D271B0 NtClose,	5_2_0000022FC0D271B0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D54740 NtFreeVirtualMemory,	5_2_0000022FC0D54740
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D37A50 NtSetContextThread,	5_2_0000022FC0D37A50
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D54BE0 NtProtectVirtualMemory,	5_2_0000022FC0D54BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D54FF0 NtQueueApcThread,	5_2_0000022FC0D54FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D3F3A0 CreateToolhelp32Snapshot,Thread32First,NtSuspendThread,NtResumeThread,Thread32Next,NtClose,	5_2_0000022FC0D3F3A0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D54360 NtCreateThreadEx,	5_2_0000022FC0D54360
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002895650DACE NtReadFile,	7_2_000002895650DACE
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002895650DA6E NtProtectVirtualMemory,	7_2_000002895650DA6E
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002895650D9FE NtOpenFile,	7_2_000002895650D9FE
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000002662484DA6E NtProtectVirtualMemory,	8_3_000002662484DA6E
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000002662484D98E NtAllocateVirtualMemory,	8_3_000002662484D98E
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000002662484DACE NtReadFile,	8_3_000002662484DACE
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000002662484D9FE NtOpenFile,	8_3_000002662484D9FE

Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D355C0	5_2_0000022FC0D355C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D39120	5_2_0000022FC0D39120
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D3B4E0	5_2_0000022FC0D3B4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D3A100	5_2_0000022FC0D3A100
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D29500	5_2_0000022FC0D29500
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D51490	5_2_0000022FC0D51490
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D47220	5_2_0000022FC0D47220
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D50210	5_2_0000022FC0D50210
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D4B5E0	5_2_0000022FC0D4B5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D455E0	5_2_0000022FC0D455E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D299D0	5_2_0000022FC0D299D0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D34DB0	5_2_0000022FC0D34DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D25D60	5_2_0000022FC0D25D60
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D44550	5_2_0000022FC0D44550
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D51F40	5_2_0000022FC0D51F40
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D2A730	5_2_0000022FC0D2A730
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D466E0	5_2_0000022FC0D466E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D3BED0	5_2_0000022FC0D3BED0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D316A0	5_2_0000022FC0D316A0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D342A0	5_2_0000022FC0D342A0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D482A0	5_2_0000022FC0D482A0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D266C0	5_2_0000022FC0D266C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D52812	5_2_0000022FC0D52812
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D3CBE0	5_2_0000022FC0D3CBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D413A3	5_2_0000022FC0D413A3
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D4FBC0	5_2_0000022FC0D4FBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D42BB0	5_2_0000022FC0D42BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000022FC0D52F60	5_2_0000022FC0D52F60

Source: badger_x64_stealth_rtl.bin.dll.dll

Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal100.troj.evad.winDLL@14/0@7/2

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_0000022FC0D3F3A0 CreateToolhelp32Snapshot,Thread32First,NtSuspendThread,NtResumeThread,Thread32Next,NtClose,

5_2_0000022FC0D3F3A0

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8016:120:WilError_03

Source: badger_x64_stealth_rtl.bin.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,DllMain

Source: badger_x64_stealth_rtl.bin.dll.dll	Virustotal: Detection: 79%
Source: badger_x64_stealth_rtl.bin.dll.dll	ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,DllMain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",DllMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",StartW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,DllMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",DllMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",StartW	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: badger_x64_stealth_rtl.bin.dll.dll

Static PE information: Image base 0x2e4d10000 > 0x60000000

Source: badger_x64_stealth_rtl.bin.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: kernel32.pdbUGP source: loaddll64.exe, 00000000.00000002.1220566576.000002321C680000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1199622220.0000022FC0C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1222841274.0000026626051000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: loaddll64.exe, 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: loaddll64.exe, 00000000.00000003.1218432026.000002321C685000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.1158677259.000002632B8A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1158383010.000001337AB98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188400593.0000022FC0C2E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1218675221.0000028957EB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1218727097.0000026626055000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: loaddll64.exe, 00000000.00000003.1218432026.000002321C685000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.1158677259.000002632B8A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1158383010.000001337AB98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188400593.0000022FC0C2E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1218675221.0000028957EB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1218727097.0000026626055000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: loaddll64.exe, 00000000.00000002.1220566576.000002321C680000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1199622220.0000022FC0C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1222841274.0000026626051000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: loaddll64.exe, 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp

Source: badger_x64_stealth_rtl.bin.dll.dll

Static PE information: real checksum: 0x4339e should be: 0x4a228

Source: badger_x64_stealth_rtl.bin.dll.dll	Static PE information: section name: .xdata
Source: badger_x64_stealth_rtl.bin.dll.dll	Static PE information: section name: .foo

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 8041 -> 49885

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

5_2_0000022FC0D44D00

Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 1781	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 8091	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 2438	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 7450	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-17933

Source: C:\Windows\System32\loaddll64.exe TID: 8012	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 8160	Thread sleep count: 1781 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 8160	Thread sleep time: -106860000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 8160	Thread sleep count: 8091 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 8160	Thread sleep time: -485460000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7600	Thread sleep count: 2438 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7600	Thread sleep time: -146280000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7600	Thread sleep count: 7450 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7600	Thread sleep time: -447000000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3-
Source: rundll32.exe, 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1358846480.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1322585214.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: rundll32.exe, 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0>
Source: rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1358846480.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1322585214.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_0000022FC0D2CCE0 LdrGetProcedureAddress,

5_2_0000022FC0D2CCE0

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_00007FFCAC161470 SetLastError,OutputDebugStringA,GetLastError,Sleep,SleepEx,

5_2_00007FFCAC161470

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 82.115.223.39 8041			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 80.78.24.30 8041			Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_00007FFCAC161380 Sleep,SleepEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

5_2_00007FFCAC161380

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtOpenFile: Indirect: 0x2321C5DDA67	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtReadFile: Indirect: 0x2321C5DDB8E	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x2321C5DDAC3	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 8084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 8084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7580	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7580	Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 8084 1

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_0000022FC0D44D00 GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

5_2_0000022FC0D44D00

Stealing of Sensitive Information

Yara detected BruteRatel

Source: Yara match	File source: 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 8156, type: MEMORYSTR

Remote Access Functionality

Yara detected BruteRatel

Source: Yara match	File source: 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 8156, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	11 Virtualization/Sandbox Evasion	21 Input Capture	11 Security Software Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	411 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	11 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
badger_x64_stealth_rtl.bin.dll.dll	79%	Virustotal		Browse
badger_x64_stealth_rtl.bin.dll.dll	76%	ReversingLabs	Win64.Hacktool.Bruterat
badger_x64_stealth_rtl.bin.dll.dll	100%	Avira	TR/AVI.Agent.boxen

Source	Detection	Scanner	Label
https://tiguanin.com:8041/A	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php$	100%	Avira URL Cloud	malware
https://greshunka.com:8041/admin.phpx	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.phpgU	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.phpl	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.phpD	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php&	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php.muip	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.phpf	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php/	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/:	100%	Avira URL Cloud	malware
https://greshunka.com:8041/5	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.phpF	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/=	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.phpU	100%	Avira URL Cloud	malware
https://tiguanin.com/b	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.phpg	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.phpk	100%	Avira URL Cloud	malware
https://greshunka.com:8041/1	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/U	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.phpt	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.php	100%	Avira URL Cloud	malware
https://greshunka.com:8041/%	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpJ=	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/I	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/dmin.php	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php.mui	100%	Avira URL Cloud	malware
https://greshunka.com:8041/&	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.phpem32	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.phpf	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/q	100%	Avira URL Cloud	malware
https://greshunka.com:8041/a	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.phpR	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpx	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/Y	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/5	100%	Avira URL Cloud	malware
https://greshunka.com:8041/in.com:8041/.	100%	Avira URL Cloud	malware
https://greshunka.com/	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/	100%	Avira URL Cloud	malware
https://greshunka.com:8041/azar.php	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.phpD	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.php6	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.php~=	100%	Avira URL Cloud	malware
https://greshunka.com/5:	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpm:8041/bazar.php	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.php	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.php7	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpf	100%	Avira URL Cloud	malware
https://greshunka.com:8041/admin.php;	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpe	100%	Avira URL Cloud	malware
https://tiguanin.com/V=6	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/I	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.php;	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpi	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.php0	100%	Avira URL Cloud	malware
https://bazarunet.com/	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phph	100%	Avira URL Cloud	malware
https://greshunka.com:8041/admin.phpA	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpl	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/azar.php	100%	Avira URL Cloud	malware
https://tiguanin.com/	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.phpqU	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/AppData	100%	Avira URL Cloud	malware
https://greshunka.com:8041/admin.phpD=	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.phpD=	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.php/	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.php:=R	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/bazar.php	100%	Avira URL Cloud	malware
https://greshunka.com:8041/nka.com:8041/admin.php	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.phpl	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/in.com:8041/	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.phpJ	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.php)	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.phpH	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/5	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/azar.php.	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.phpe	100%	Avira URL Cloud	malware
https://greshunka.com:8041/nk	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/admin.php2	100%	Avira URL Cloud	malware
https://greshunka.com:8041/admin.php	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/p	100%	Avira URL Cloud	malware
https://greshunka.com:8041/bazar.php;	100%	Avira URL Cloud	malware
https://greshunka.com:8041/admin.phpV=6	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.phpX	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/nka.com:8041/	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/admin.php	100%	Avira URL Cloud	malware
https://greshunka.com:8041/	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/nka.com:8041/	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/in.com:8041/.	100%	Avira URL Cloud	malware
https://tiguanin.com:8041/bazar.phpR	100%	Avira URL Cloud	malware
https://bazarunet.com:8041/AppData	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
greshunka.com	82.115.223.39	true	true	unknown
tiguanin.com	80.78.24.30	true	true	unknown
bazarunet.com	80.78.24.30	true	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://tiguanin.com:8041/admin.phpD	rundll32.exe, 00000005.00000003.1345981976.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php&	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpl	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php$	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php.muip	rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/A	rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.phpgU	rundll32.exe, 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/admin.phpx	rundll32.exe, 00000008.00000002.2421895839.00000266246B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php/	rundll32.exe, 00000005.00000003.1292025266.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1275952668.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1322539060.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpf	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1867333603.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1672357732.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1535482489.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1542184485.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1704975885.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/:	rundll32.exe, 00000005.00000003.1256467181.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.phpF	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/5	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/=	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.phpU	rundll32.exe, 00000008.00000003.1456138536.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1396754431.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1403153176.0000026626089000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.phpg	rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com/b	rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1256467181.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.phpk	rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/1	rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/U	rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.php	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1867333603.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1672357732.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1535482489.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1542184485.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1704975885.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpt	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/%	rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/I	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/&	rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php.mui	rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpJ=	rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/dmin.php	rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.phpem32	rundll32.exe, 00000005.00000003.1470533154.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.phpf	rundll32.exe, 00000008.00000003.1456138536.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1396754431.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1403153176.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1867333603.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/a	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/q	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.phpR	rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/Y	rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpx	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/in.com:8041/.	rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/5	rundll32.exe, 00000005.00000003.1346012770.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/	rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com/	rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/azar.php	rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.php6	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.phpD	rundll32.exe, 00000005.00000003.1358833561.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com/5:	rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.php~=	rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpm:8041/bazar.php	rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.php	rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1704975885.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpf	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.php7	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/admin.php;	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpe	rundll32.exe, 00000005.00000003.1392321407.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com/V=6	rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/I	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.php;	rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpi	rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com/	rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1358846480.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phph	rundll32.exe, 00000008.00000003.1672357732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.php0	rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpl	rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/admin.phpA	rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/	rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/azar.php	rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com/	rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.phpqU	rundll32.exe, 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/AppData	rundll32.exe, 00000005.00000003.1322585214.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1256467181.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.phpD=	rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/admin.phpD=	rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.php:=R	rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php	rundll32.exe, 00000008.00000003.1327035826.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.php/	rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1556192704.0000022FC0C5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2037529076.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1982872875.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1957812418.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1613791133.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/bazar.php	rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1358833561.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1360003153.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1353770640.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1844456570.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390355797.0000026626089000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1811391840.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1599608196.0000026626088000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1748279732.0000026626088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/nka.com:8041/admin.php	rundll32.exe, 00000005.00000003.1519447709.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/in.com:8041/	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.phpl	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.phpJ	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.php)	rundll32.exe, 00000005.00000003.1345981976.0000022FC0C5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpH	rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2422820899.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2094052115.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/azar.php.	rundll32.exe, 00000005.00000002.2422820899.0000022FC0C22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpF	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bazarunet.com:8041/5	rundll32.exe, 00000005.00000003.1470533154.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.phpe	rundll32.exe, 00000005.00000003.1407276530.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/nk	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/admin.php	rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/p	rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/admin.php2	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662607A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/bazar.php;	rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/admin.phpV=6	rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpX	rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://greshunka.com:8041/	rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626079000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662607A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/nka.com:8041/	rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/admin.php	rundll32.exe, 00000005.00000003.2148463753.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407235703.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1398680355.0000022FC0C5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2148463753.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1390370915.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1288649167.000002662605C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1456156800.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.1528807891.000002662605B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2422408124.0000026626052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/nka.com:8041/	rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1407276530.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1470533154.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1346012770.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/bazar.phpR	rundll32.exe, 00000005.00000003.1519447709.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1525689087.0000022FC0C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tiguanin.com:8041/in.com:8041/.	rundll32.exe, 00000005.00000003.2094052115.0000022FC0C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bazarunet.com:8041/AppData	rundll32.exe, 00000005.00000003.1358846480.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1392321407.0000022FC0C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
82.115.223.39	greshunka.com	Russian Federation		209821	MIDNET-ASTK-TelecomRU	true
80.78.24.30	tiguanin.com	Cyprus		37560	CYBERDYNELR	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637286
Start date and time:	2025-03-13 13:45:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	badger_x64_stealth_rtl.bin.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	badger_x64_stealth_rtl.bin.dll.exe
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@14/0@7/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 30

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 20.3.187.198, 52.149.20.212, 40.69.42.241, 172.202.163.200
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, fs.microsoft.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 7596 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 8068 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:46:18	API Interceptor	5233305x Sleep call for process: rundll32.exe modified
08:46:21	API Interceptor	1x Sleep call for process: loaddll64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
82.115.223.39	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel	Browse
	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-18-33-08.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse
80.78.24.30	e664858e8b8ff1ac08f6dd812a68d65d05a704262fa13862538c3c45.vbs	Get hash	malicious	Unknown	Browse	fredlomberhfile.com:2351/lpfdokkq
	s5YgOFFmFK.exe	Get hash	malicious	IcedID	Browse	smockalifatori.com/
	CiMXn78mMb.exe	Get hash	malicious	IcedID	Browse	skayfingertawr.com/
	Scan_06-28_INV__70.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	Scan_06-28_INV__70.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	Scan_06-28_INV__10.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	Scan_06-28_INV__10.exe	Get hash	malicious	IcedID	Browse	hloyagorepa.com/
	05387199.exe	Get hash	malicious	IcedID	Browse	shoterqana.com/
	08778399.exe	Get hash	malicious	IcedID	Browse	shoterqana.com/
	Contract_March_23_INV#305.exe	Get hash	malicious	IcedID	Browse	aoureskindzet.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bazarunet.com	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse	80.78.24.30
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	80.78.24.30
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel	Browse	80.78.24.30
	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	Document-18-33-08.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	185.106.92.54
tiguanin.com	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse	80.78.24.30
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	80.78.24.30
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel	Browse	80.78.24.30
	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	Document-18-33-08.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	80.78.24.30
	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.40
greshunka.com	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse	82.115.223.39
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	82.115.223.39
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel	Browse	82.115.223.39
	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	Document-18-33-08.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	Document-19-51-48.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39
	dsa.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	82.115.223.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIDNET-ASTK-TelecomRU	xkRz9mX6UD.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader, zgRAT	Browse	82.115.223.6
	SecuriteInfo.com.Win64.DropperX-gen.32756.21147.exe	Get hash	malicious	Unknown	Browse	82.115.223.119
	SecuriteInfo.com.FileRepMalware.14454.19835.exe	Get hash	malicious	Unknown	Browse	82.115.223.119
	SecuriteInfo.com.Win64.DropperX-gen.28891.2079.exe	Get hash	malicious	Unknown	Browse	82.115.223.119
	SecuriteInfo.com.FileRepMalware.14454.19835.exe	Get hash	malicious	Unknown	Browse	82.115.223.119
	mQRr8Rkorf.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	82.115.223.119
	anydesk.ps1	Get hash	malicious	Unknown	Browse	82.115.223.199
	runner (2).ps1	Get hash	malicious	Unknown	Browse	82.115.223.199
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse	82.115.223.222
	random.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222
CYBERDYNELR	StoneHunt.exe	Get hash	malicious	Unknown	Browse	80.78.25.57
	abc.exe	Get hash	malicious	Unknown	Browse	80.78.24.161
	259650.msi.bin.msi	Get hash	malicious	Unknown	Browse	80.78.25.233
	4DKyxpySwD.exe	Get hash	malicious	Unknown	Browse	80.78.24.144
	IxKxeedaAq.exe	Get hash	malicious	Unknown	Browse	80.78.24.144
	adscript.ps1	Get hash	malicious	Unknown	Browse	80.78.24.144
	4DKyxpySwD.exe	Get hash	malicious	Unknown	Browse	80.78.24.144
	IxKxeedaAq.exe	Get hash	malicious	Unknown	Browse	80.78.24.144
	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	80.78.28.66
	EdiAf.x86.elf	Get hash	malicious	Okiru	Browse	80.78.28.66

File type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.922535602758538
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	badger_x64_stealth_rtl.bin.dll.dll
File size:	288'768 bytes
MD5:	decf7b259d75e0e499f44c5a915b3175
SHA1:	af87c4222d4538fd4d43eaa0cb30974af08ea21e
SHA256:	ba847f3edf4f9c540641c30f45e40baee8287d30d5aef59543d24f0375140f27
SHA512:	7602933fc82ca0c974ab2803ee833af6db325cbea6dc5d4cf7b2a5c83205342d57d2e852b9e1225026cad1bc56f4574fe8bc0419fb31e1b68f00712cc4921b5b
SSDEEP:	6144:Gq2UhPqeabCJNzgNm/qVoe93Zi861RyyZMAyqK2kY:bBhJNzOOQJi86Sy
TLSH:	80541287A450C08CCDE7DD30A2EAF5F2BC3C3F5B087195A89A28E5343E513A96B5925D
File Content Preview:	MZ......................@.......................................................................................................PE..d....].f..........."...+............0................................................3....`... ............................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x2e4d11330
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x2e4d10000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66D85DFB [Wed Sep 4 13:17:47 2024 UTC]
TLS Callbacks:	0xe4d11c30, 0x2, 0xe4d11c00, 0x2
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5821847e9de43275356a37b9a2b0a5b6

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
mov eax, dword ptr [0003FF09h]
mov dword ptr [eax], 00000000h
jmp 00007F9A80E18993h
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
mov edx, ecx
dec eax
lea ecx, dword ptr [00042CA6h]
jmp 00007F9A80E1A0C6h
nop
ret
nop word ptr [eax+eax+00000000h]
dec eax
jmp ecx
nop word ptr [eax+eax+00000000h]
inc ecx
push edi
inc ecx
push esi
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 48h
inc esp
mov esi, ecx
dec esp
mov edi, eax
dec ecx
mov edi, edx
dec ecx
mov esp, ecx
mov ecx, dword ptr [esp+000000A0h]
call dword ptr [00044DDAh]
mov dword ptr [esp+20h], 00000040h
inc ebp
xor esi, esi
dec eax
mov ecx, FFFFFFFFh
xor edx, edx
dec ebp
mov eax, edi
inc ecx
mov ecx, 00003000h
call dword ptr [00044DC7h]
dec eax
test eax, eax
je 00007F9A80E18B8Ah
dec eax
mov ebx, eax
dec eax
mov dword ptr [esp+40h], 00000000h
dec eax
lea eax, dword ptr [esp+40h]
dec eax
mov dword ptr [esp+20h], eax
dec eax
mov ecx, FFFFFFFFh
dec eax
mov edx, ebx
dec ebp
mov eax, esp
dec ebp
mov ecx, edi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x45000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x46000	0x498	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x1f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x41600	0x4d50
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49000	0x58	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x41040	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x46140	0x100	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b80	0x1c00	ebb3a84c3a550fd9b0c3995e1d01ef65	False	0.5662667410714286	data	6.176884606484243	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x3dc40	0x3de00	927d8b32d17b417b562d693dc821c26f	False	0.9862492108585859	Matlab v4 mat-file (little endian) H1\300PTh5\001, text, rows 0, columns 0	7.991499402397265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x41000	0x520	0x600	898d3d727d412258d920c37fb0cbbd4a	False	0.21940104166666666	data	3.5802772653959076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x42000	0x1f8	0x200	29e587adbaacc260d4b877cce37b7bb5	False	0.5859375	data	4.069216292695712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x43000	0x1b4	0x200	c6873c9ae49b91e632ce393e15495785	False	0.384765625	data	3.7866992937304613	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x44000	0x110	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x45000	0x71	0x200	70a486219da17d2e8c1fa5668cfa46a7	False	0.20703125	data	1.3976770861143486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x46000	0x498	0x600	aeb57a2b4f459177befc6f70055bbac1	False	0.3098958333333333	data	3.375139724546761	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x47000	0x58	0x200	726c35a2d6f1fdf8b613cc166a7f5955	False	0.056640625	data	0.23291060709026676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x48000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x49000	0x58	0x200	5004db65c252901ea6a29527aad4b1e2	False	0.1953125	data	1.1047720205888238	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.foo	0x4a000	0x16	0x200	4dfd3543d62b8c6fde2a707722c300bb	False	0.060546875	ASCII text, with no line terminators	0.42392072243894613	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	CreateRemoteThread, DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, OutputDebugStringA, SetLastError, Sleep, TlsGetValue, VirtualAllocEx, VirtualProtect, VirtualQuery, WaitForSingleObject, WriteProcessMemory
msvcrt.dll	__iob_func, _amsg_exit, _initterm, _lock, _unlock, _wcsnicmp, abort, calloc, exit, free, fwrite, realloc, strlen, strncmp, vfprintf

Exports

Name	Ordinal	Address
DllMain	1	0x2e4d11530
StartW	2	0x2e4d11510

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 13:46:22.501266003 CET	49724	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:22.506016970 CET	8041	49724	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:22.506095886 CET	49724	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:22.567703962 CET	49724	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:22.572386980 CET	8041	49724	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.121745110 CET	8041	49724	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.121901035 CET	8041	49724	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.121975899 CET	49724	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.121975899 CET	49724	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.124732971 CET	49724	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.126720905 CET	49726	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.129345894 CET	8041	49724	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.131450891 CET	8041	49726	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.131757021 CET	49726	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.131757021 CET	49726	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.136467934 CET	8041	49726	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.751617908 CET	8041	49726	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.751631021 CET	8041	49726	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.751713037 CET	49726	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.752099037 CET	49726	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.755436897 CET	49727	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.756715059 CET	8041	49726	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.760158062 CET	8041	49727	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.760222912 CET	49727	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.760308981 CET	49727	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:23.765017986 CET	8041	49727	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:23.765070915 CET	49727	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:25.675146103 CET	49729	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:25.680541992 CET	8041	49729	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:25.680598021 CET	49729	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:25.719569921 CET	49729	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:25.724262953 CET	8041	49729	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.141830921 CET	49732	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:26.146557093 CET	8041	49732	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:26.146616936 CET	49732	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:26.146991968 CET	49732	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:26.151649952 CET	8041	49732	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:26.302337885 CET	8041	49729	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.302387953 CET	8041	49729	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.302392006 CET	49729	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.302428007 CET	49729	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.302700996 CET	49729	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.306616068 CET	49733	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.307343960 CET	8041	49729	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.311315060 CET	8041	49733	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.311377048 CET	49733	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.311691999 CET	49733	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.316394091 CET	8041	49733	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.952316046 CET	8041	49733	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.952436924 CET	8041	49733	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.952470064 CET	49733	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.952827930 CET	49733	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.953305006 CET	49733	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.957535028 CET	8041	49733	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.960823059 CET	49734	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.967253923 CET	8041	49734	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.967442036 CET	49734	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.967544079 CET	49734	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:26.972315073 CET	8041	49734	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:26.972671986 CET	49734	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:27.748815060 CET	8041	49732	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:27.748902082 CET	49732	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:27.749001980 CET	49732	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:27.752975941 CET	49735	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:27.753647089 CET	8041	49732	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:27.757677078 CET	8041	49735	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:27.757740974 CET	49735	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:27.758017063 CET	49735	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:27.762638092 CET	8041	49735	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:29.356317997 CET	8041	49735	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:29.356491089 CET	49735	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.356491089 CET	49735	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.360022068 CET	49736	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.361216068 CET	8041	49735	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:29.364727020 CET	8041	49736	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:29.364789009 CET	49736	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.364852905 CET	49736	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.369838953 CET	8041	49736	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:29.370016098 CET	49736	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.390611887 CET	49737	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.395351887 CET	8041	49737	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:29.395420074 CET	49737	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.395667076 CET	49737	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:29.400296926 CET	8041	49737	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:31.249453068 CET	8041	49737	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:31.249510050 CET	49737	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:31.249608994 CET	49737	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:31.254394054 CET	8041	49737	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:31.254669905 CET	49739	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:31.259366035 CET	8041	49739	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:31.259437084 CET	49739	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:31.259800911 CET	49739	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:31.264445066 CET	8041	49739	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:32.437158108 CET	49741	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:32.441922903 CET	8041	49741	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:32.441991091 CET	49741	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:32.442374945 CET	49741	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:32.447022915 CET	8041	49741	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:32.857604027 CET	8041	49739	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:32.857661963 CET	49739	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:32.857736111 CET	49739	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:32.860771894 CET	49742	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:32.862344980 CET	8041	49739	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:32.865467072 CET	8041	49742	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:32.865535021 CET	49742	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:32.865638018 CET	49742	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:32.870347023 CET	8041	49742	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:32.870397091 CET	49742	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:33.079308033 CET	8041	49741	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.079426050 CET	8041	49741	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.079473019 CET	49741	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.079523087 CET	49741	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.079798937 CET	49741	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.080218077 CET	49743	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.084469080 CET	8041	49741	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.084867001 CET	8041	49743	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.084925890 CET	49743	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.085113049 CET	49743	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.089752913 CET	8041	49743	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.705588102 CET	8041	49743	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.706036091 CET	49743	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.706362963 CET	49743	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.706562042 CET	8041	49743	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.706715107 CET	49744	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.706738949 CET	49743	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.711002111 CET	8041	49743	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.711441994 CET	8041	49744	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.711503029 CET	49744	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.711580038 CET	49744	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:33.717345953 CET	8041	49744	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:33.717757940 CET	49744	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.768549919 CET	49745	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.773297071 CET	8041	49745	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:34.773389101 CET	49745	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.773633003 CET	49745	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.778266907 CET	8041	49745	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:34.900094986 CET	49746	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.904831886 CET	8041	49746	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:34.904902935 CET	49746	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.905209064 CET	49746	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:34.909910917 CET	8041	49746	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.385831118 CET	8041	49745	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.386039019 CET	49745	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.386123896 CET	8041	49745	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.386182070 CET	49745	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.386333942 CET	49745	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.386667013 CET	49747	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.391020060 CET	8041	49745	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.391374111 CET	8041	49747	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.391432047 CET	49747	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.391618967 CET	49747	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.396245956 CET	8041	49747	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.530623913 CET	8041	49746	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.530682087 CET	49746	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.530775070 CET	8041	49746	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.530831099 CET	49746	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.531080008 CET	49746	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.535725117 CET	8041	49746	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.536952019 CET	49748	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.541697025 CET	8041	49748	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:35.541759014 CET	49748	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.542037010 CET	49748	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:35.546871901 CET	8041	49748	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.003824949 CET	8041	49747	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.003878117 CET	49747	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.004033089 CET	8041	49747	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.004074097 CET	49747	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.004193068 CET	49747	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.004724979 CET	49749	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.008799076 CET	8041	49747	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.009433985 CET	8041	49749	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.009502888 CET	49749	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.009617090 CET	49749	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.014331102 CET	8041	49749	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.014393091 CET	49749	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.050481081 CET	49750	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:36.055201054 CET	8041	49750	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:36.055263996 CET	49750	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:36.055460930 CET	49750	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:36.060185909 CET	8041	49750	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:36.153944969 CET	8041	49748	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.154063940 CET	49748	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.154205084 CET	8041	49748	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.154264927 CET	49748	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.154279947 CET	49748	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.158816099 CET	49751	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.159003973 CET	8041	49748	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.163539886 CET	8041	49751	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.163618088 CET	49751	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.164036036 CET	49751	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:36.168737888 CET	8041	49751	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:36.168787956 CET	49751	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:37.651527882 CET	8041	49750	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:37.651695967 CET	49750	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:37.651787996 CET	49750	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:37.652355909 CET	49752	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:37.656443119 CET	8041	49750	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:37.657134056 CET	8041	49752	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:37.657207012 CET	49752	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:37.657572031 CET	49752	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:37.662333012 CET	8041	49752	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:39.203876019 CET	49753	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.208621979 CET	8041	49753	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.208690882 CET	49753	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.208997965 CET	49753	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.213633060 CET	8041	49753	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.347563028 CET	8041	49752	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:39.347630024 CET	49752	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:39.347703934 CET	49752	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:39.348140955 CET	49754	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:39.352349043 CET	8041	49752	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:39.352817059 CET	8041	49754	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:39.352873087 CET	49754	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:39.353022099 CET	49754	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:39.357770920 CET	8041	49754	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:39.357817888 CET	49754	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:39.400573969 CET	49755	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.405292988 CET	8041	49755	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.405344009 CET	49755	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.405654907 CET	49755	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.410295010 CET	8041	49755	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.829086065 CET	8041	49753	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.829145908 CET	49753	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.829185963 CET	8041	49753	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.829322100 CET	49753	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.829560995 CET	49753	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.832945108 CET	49756	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.834177971 CET	8041	49753	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.837652922 CET	8041	49756	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:39.837729931 CET	49756	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.838033915 CET	49756	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:39.842677116 CET	8041	49756	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.017576933 CET	8041	49755	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.017628908 CET	49755	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.017651081 CET	8041	49755	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.017693043 CET	49755	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.019721031 CET	49755	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.024394989 CET	8041	49755	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.028006077 CET	49757	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.032737017 CET	8041	49757	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.032812119 CET	49757	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.034046888 CET	49757	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.038700104 CET	8041	49757	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.459273100 CET	8041	49756	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.459371090 CET	8041	49756	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.459417105 CET	49756	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.459687948 CET	49756	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.459687948 CET	49756	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.464416981 CET	8041	49756	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.476490021 CET	49758	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.481148958 CET	8041	49758	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.481220007 CET	49758	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.481451035 CET	49758	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.486097097 CET	8041	49758	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.486146927 CET	49758	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.673372030 CET	8041	49757	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.673448086 CET	49757	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.673690081 CET	8041	49757	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.673732996 CET	49757	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.762095928 CET	49757	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.766782999 CET	8041	49757	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.798069954 CET	49759	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.802870989 CET	8041	49759	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.802936077 CET	49759	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.810774088 CET	49759	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.815462112 CET	8041	49759	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.815502882 CET	49759	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.915183067 CET	49760	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.919888973 CET	8041	49760	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:40.919954062 CET	49760	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.920604944 CET	49760	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:40.925285101 CET	8041	49760	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:41.560395956 CET	8041	49760	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:41.560465097 CET	49760	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:41.560513973 CET	8041	49760	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:41.560559034 CET	49760	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:41.560806036 CET	49760	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:41.561160088 CET	49761	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:41.565448046 CET	8041	49760	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:41.565815926 CET	8041	49761	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:41.565875053 CET	49761	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:41.566349983 CET	49761	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:41.571002007 CET	8041	49761	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:42.178523064 CET	8041	49761	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:42.178606033 CET	8041	49761	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:42.178634882 CET	49761	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:42.178647995 CET	49761	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:42.178926945 CET	49761	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:42.179306030 CET	49762	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:42.183520079 CET	8041	49761	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:42.183979988 CET	8041	49762	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:42.184047937 CET	49762	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:42.184127092 CET	49762	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:42.188983917 CET	8041	49762	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:42.189057112 CET	49762	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:45.783318043 CET	49763	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:45.788108110 CET	8041	49763	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:45.788189888 CET	49763	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:45.788502932 CET	49763	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:45.793176889 CET	8041	49763	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:47.220102072 CET	49764	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.224901915 CET	8041	49764	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:47.224992037 CET	49764	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.225208044 CET	49764	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.229876995 CET	8041	49764	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:47.387999058 CET	8041	49763	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:47.388086081 CET	49763	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.388219118 CET	49763	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.392995119 CET	8041	49763	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:47.393352032 CET	49765	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.398000002 CET	8041	49765	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:47.398078918 CET	49765	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.398355961 CET	49765	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:47.402956963 CET	8041	49765	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:48.826735973 CET	8041	49764	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:48.826816082 CET	49764	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:48.826931000 CET	49764	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:48.827310085 CET	49766	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:48.831615925 CET	8041	49764	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:48.832014084 CET	8041	49766	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:48.832073927 CET	49766	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:48.832284927 CET	49766	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:48.836980104 CET	8041	49766	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:49.000277996 CET	8041	49765	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:49.000380039 CET	49765	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:49.009876966 CET	49765	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:49.013267994 CET	49767	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:49.014631987 CET	8041	49765	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:49.017981052 CET	8041	49767	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:49.018054008 CET	49767	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:49.018188000 CET	49767	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:49.022937059 CET	8041	49767	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:49.022991896 CET	49767	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:50.438069105 CET	8041	49766	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:50.438132048 CET	49766	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:50.438220978 CET	49766	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:50.438793898 CET	49768	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:50.442872047 CET	8041	49766	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:50.443449974 CET	8041	49768	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:50.443514109 CET	49768	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:50.443656921 CET	49768	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:50.448637009 CET	8041	49768	82.115.223.39	192.168.2.4
Mar 13, 2025 13:46:50.448687077 CET	49768	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:46:51.479738951 CET	49769	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:51.484522104 CET	8041	49769	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:51.484599113 CET	49769	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:51.485816956 CET	49769	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:51.490485907 CET	8041	49769	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.097517967 CET	8041	49769	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.097527981 CET	8041	49769	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.097574949 CET	49769	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.097811937 CET	49769	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.102475882 CET	8041	49769	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.104239941 CET	49770	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.108957052 CET	8041	49770	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.109024048 CET	49770	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.109270096 CET	49770	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.114475965 CET	8041	49770	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.721174002 CET	8041	49770	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.721241951 CET	49770	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.721363068 CET	8041	49770	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.721405983 CET	49770	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.721515894 CET	49770	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.726171970 CET	8041	49770	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.729031086 CET	49771	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.733710051 CET	8041	49771	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.733772039 CET	49771	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.733851910 CET	49771	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.738607883 CET	8041	49771	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.738660097 CET	49771	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.778944969 CET	49772	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.783631086 CET	8041	49772	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:52.783693075 CET	49772	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.783931971 CET	49772	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:52.788562059 CET	8041	49772	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.048329115 CET	49773	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.053112984 CET	8041	49773	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.053183079 CET	49773	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.053442001 CET	49773	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.058068037 CET	8041	49773	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.427469969 CET	8041	49772	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.427548885 CET	49772	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.427721024 CET	8041	49772	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.427772999 CET	49772	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.428045034 CET	49772	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.428457022 CET	49774	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.432710886 CET	8041	49772	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.433209896 CET	8041	49774	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.433279037 CET	49774	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.433542013 CET	49774	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.438201904 CET	8041	49774	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.700427055 CET	8041	49773	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.700500011 CET	49773	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.700512886 CET	8041	49773	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.700557947 CET	49773	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.700767040 CET	49773	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.705503941 CET	8041	49773	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.706908941 CET	49775	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.711570978 CET	8041	49775	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:53.711642981 CET	49775	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.711883068 CET	49775	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:53.716568947 CET	8041	49775	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.062762022 CET	8041	49774	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.062901974 CET	49774	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.063189983 CET	49774	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.063273907 CET	8041	49774	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.063342094 CET	49774	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.063602924 CET	49776	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.067848921 CET	8041	49774	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.068262100 CET	8041	49776	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.068324089 CET	49776	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.068381071 CET	49776	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.073585987 CET	8041	49776	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.073638916 CET	49776	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.370870113 CET	8041	49775	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.370908976 CET	8041	49775	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.370934010 CET	49775	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.370965958 CET	49775	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.371186018 CET	49775	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.375730038 CET	49777	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.375817060 CET	8041	49775	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.380410910 CET	8041	49777	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.380479097 CET	49777	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.380630970 CET	49777	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:54.385344982 CET	8041	49777	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:54.385395050 CET	49777	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.088825941 CET	49778	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.093672037 CET	8041	49778	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:55.093800068 CET	49778	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.094122887 CET	49778	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.100220919 CET	8041	49778	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:55.771673918 CET	8041	49778	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:55.771692991 CET	8041	49778	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:55.771783113 CET	49778	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.772006989 CET	49778	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.776456118 CET	49779	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.776659012 CET	8041	49778	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:55.781168938 CET	8041	49779	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:55.781229019 CET	49779	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.781472921 CET	49779	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:55.786124945 CET	8041	49779	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:56.395648956 CET	8041	49779	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:56.395668983 CET	8041	49779	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:56.395838976 CET	49779	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:56.489902973 CET	49779	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:56.494589090 CET	8041	49779	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:56.547934055 CET	49780	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:56.552628994 CET	8041	49780	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:56.552687883 CET	49780	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:56.552922010 CET	49780	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:56.557668924 CET	8041	49780	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:56.557706118 CET	49780	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:59.497777939 CET	49781	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:59.502553940 CET	8041	49781	80.78.24.30	192.168.2.4
Mar 13, 2025 13:46:59.502625942 CET	49781	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:59.505891085 CET	49781	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:46:59.510584116 CET	8041	49781	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.112761021 CET	8041	49781	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.112844944 CET	49781	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.112878084 CET	8041	49781	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.112920046 CET	49781	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.113152981 CET	49781	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.117825031 CET	8041	49781	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.118197918 CET	49782	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.122906923 CET	8041	49782	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.122978926 CET	49782	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.123383999 CET	49782	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.128036976 CET	8041	49782	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.758647919 CET	8041	49782	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.758780003 CET	49782	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.758869886 CET	8041	49782	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.758929968 CET	49782	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.759114027 CET	49782	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.763036013 CET	49783	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.763726950 CET	8041	49782	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.767700911 CET	8041	49783	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.767775059 CET	49783	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.767894983 CET	49783	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.772896051 CET	8041	49783	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.773430109 CET	49783	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.868520021 CET	49784	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.873358965 CET	8041	49784	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:00.873610973 CET	49784	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.873842001 CET	49784	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:00.878472090 CET	8041	49784	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:01.530878067 CET	8041	49784	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:01.530951977 CET	8041	49784	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:01.530967951 CET	49784	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:01.531004906 CET	49784	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:01.531244040 CET	49784	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:01.535962105 CET	8041	49784	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:01.536533117 CET	49785	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:01.541311026 CET	8041	49785	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:01.541388035 CET	49785	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:01.541636944 CET	49785	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:01.546365976 CET	8041	49785	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:02.182517052 CET	8041	49785	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:02.182578087 CET	8041	49785	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:02.182626963 CET	49785	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:02.182679892 CET	49785	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:02.250504017 CET	49785	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:02.253922939 CET	49786	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:02.255284071 CET	8041	49785	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:02.258682966 CET	8041	49786	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:02.258748055 CET	49786	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:02.258831024 CET	49786	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:02.263703108 CET	8041	49786	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:02.263772964 CET	49786	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:05.800314903 CET	49787	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:05.805095911 CET	8041	49787	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:05.805160999 CET	49787	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:05.805568933 CET	49787	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:05.810209036 CET	8041	49787	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:07.386648893 CET	8041	49787	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:07.386862993 CET	49787	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.386862993 CET	49787	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.391556025 CET	8041	49787	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:07.395565033 CET	49788	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.400223970 CET	8041	49788	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:07.400298119 CET	49788	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.400562048 CET	49788	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.405214071 CET	8041	49788	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:07.426099062 CET	49789	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.430875063 CET	8041	49789	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:07.434144974 CET	49789	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.434415102 CET	49789	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:07.439136028 CET	8041	49789	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:08.997551918 CET	8041	49788	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:08.997685909 CET	49788	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:08.997778893 CET	49788	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:08.999643087 CET	49790	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.002460957 CET	8041	49788	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:09.004373074 CET	8041	49790	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:09.004451036 CET	49790	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.004584074 CET	49790	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.009752989 CET	8041	49790	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:09.009819031 CET	49790	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.028068066 CET	8041	49789	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:09.028114080 CET	49789	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.028177977 CET	49789	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.028614044 CET	49791	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.032803059 CET	8041	49789	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:09.033277035 CET	8041	49791	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:09.033345938 CET	49791	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.033580065 CET	49791	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:09.038197041 CET	8041	49791	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:10.026412010 CET	49792	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.031490088 CET	8041	49792	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.031605005 CET	49792	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.031961918 CET	49792	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.036580086 CET	8041	49792	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.622777939 CET	8041	49791	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:10.623043060 CET	49791	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:10.623121023 CET	49791	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:10.623719931 CET	49793	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:10.627851963 CET	8041	49791	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:10.628520966 CET	8041	49793	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:10.628633022 CET	49793	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:10.628933907 CET	49793	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:10.633702993 CET	8041	49793	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:10.633749962 CET	49793	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:10.647814035 CET	8041	49792	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.647871017 CET	49792	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.647969007 CET	8041	49792	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.648010015 CET	49792	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.648149967 CET	49792	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.652770996 CET	8041	49792	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.657061100 CET	49794	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.661823034 CET	8041	49794	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.661894083 CET	49794	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.662116051 CET	49794	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.666737080 CET	8041	49794	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.683043003 CET	49795	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.687844992 CET	8041	49795	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:10.687928915 CET	49795	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.688196898 CET	49795	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:10.692879915 CET	8041	49795	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.302711010 CET	8041	49794	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.302860975 CET	8041	49794	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.302897930 CET	49794	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.302974939 CET	49794	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.303106070 CET	49794	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.306917906 CET	49797	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.307703972 CET	8041	49794	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.312048912 CET	8041	49797	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.312129021 CET	49797	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.312252998 CET	49797	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.316977024 CET	8041	49797	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.317028999 CET	49797	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.320375919 CET	8041	49795	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.320389986 CET	8041	49795	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.320449114 CET	49795	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.320493937 CET	49795	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.320708036 CET	49795	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.321089983 CET	49798	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.326237917 CET	8041	49795	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.326821089 CET	8041	49798	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.326886892 CET	49798	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.328675032 CET	49798	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.334316969 CET	8041	49798	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.935664892 CET	8041	49798	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.935739994 CET	49798	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.935795069 CET	8041	49798	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.935847998 CET	49798	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.936914921 CET	49798	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.937294960 CET	49799	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.941567898 CET	8041	49798	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.942102909 CET	8041	49799	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.942184925 CET	49799	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.942302942 CET	49799	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:11.947171926 CET	8041	49799	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:11.947228909 CET	49799	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.354079962 CET	49800	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.358788013 CET	8041	49800	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:14.358865976 CET	49800	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.359154940 CET	49800	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.363770962 CET	8041	49800	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:14.980206966 CET	8041	49800	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:14.980319977 CET	8041	49800	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:14.980329990 CET	49800	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.980365992 CET	49800	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.980628014 CET	49800	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.985246897 CET	8041	49800	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:14.985682964 CET	49801	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.990387917 CET	8041	49801	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:14.994148970 CET	49801	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.994446993 CET	49801	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:14.999095917 CET	8041	49801	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.615822077 CET	8041	49801	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.615926981 CET	8041	49801	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.615989923 CET	49801	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.615989923 CET	49801	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.616173029 CET	49801	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.619436026 CET	49802	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.620786905 CET	8041	49801	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.624207020 CET	8041	49802	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.624270916 CET	49802	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.624350071 CET	49802	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.629086018 CET	8041	49802	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.629144907 CET	49802	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.978204012 CET	49803	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.982964039 CET	8041	49803	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:15.983035088 CET	49803	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.983258963 CET	49803	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:15.987863064 CET	8041	49803	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:16.620476961 CET	8041	49803	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:16.620548964 CET	49803	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:16.620583057 CET	8041	49803	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:16.620628119 CET	49803	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:16.620822906 CET	49803	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:16.621144056 CET	49804	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:16.626087904 CET	8041	49803	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:16.626632929 CET	8041	49804	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:16.626692057 CET	49804	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:16.626919031 CET	49804	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:16.631820917 CET	8041	49804	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.268069983 CET	8041	49804	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.268086910 CET	8041	49804	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.268134117 CET	49804	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:17.268156052 CET	49804	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:17.268414974 CET	49804	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:17.268785954 CET	49805	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:17.272995949 CET	8041	49804	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.273451090 CET	8041	49805	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.273511887 CET	49805	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:17.273631096 CET	49805	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:17.284195900 CET	8041	49805	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.285728931 CET	8041	49805	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:17.285770893 CET	49805	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.307946920 CET	49806	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.312855959 CET	8041	49806	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:19.312932014 CET	49806	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.313175917 CET	49806	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.317816973 CET	8041	49806	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:19.953242064 CET	8041	49806	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:19.953315020 CET	49806	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.953408003 CET	8041	49806	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:19.953474045 CET	49806	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.953690052 CET	49806	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.954066992 CET	49807	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.958648920 CET	8041	49806	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:19.959455013 CET	8041	49807	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:19.959530115 CET	49807	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.959755898 CET	49807	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:19.964900970 CET	8041	49807	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.592772961 CET	8041	49807	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.592849016 CET	49807	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.592962980 CET	8041	49807	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.593003988 CET	49807	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.593097925 CET	49807	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.593462944 CET	49808	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.597765923 CET	8041	49807	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.598165035 CET	8041	49808	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.598237991 CET	49808	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.598354101 CET	49808	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.603041887 CET	8041	49808	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.603095055 CET	49808	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.650825024 CET	49809	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.655563116 CET	8041	49809	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:20.655639887 CET	49809	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.655858994 CET	49809	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:20.660540104 CET	8041	49809	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.288511038 CET	8041	49809	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.288583040 CET	49809	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.288856983 CET	49809	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.290175915 CET	8041	49809	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.290221930 CET	49809	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.295097113 CET	8041	49809	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.299061060 CET	49810	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.305598021 CET	8041	49810	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.305669069 CET	49810	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.305896044 CET	49810	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.312268019 CET	8041	49810	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.917766094 CET	8041	49810	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.917841911 CET	49810	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.917853117 CET	8041	49810	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.917896986 CET	49810	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.918112993 CET	49810	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.922183990 CET	49811	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.923070908 CET	8041	49810	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.926884890 CET	8041	49811	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.926954985 CET	49811	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.927089930 CET	49811	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:21.932080984 CET	8041	49811	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:21.932131052 CET	49811	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.624048948 CET	49812	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.628839970 CET	8041	49812	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:23.628922939 CET	49812	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.629169941 CET	49812	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.633802891 CET	8041	49812	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:23.948576927 CET	49813	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.953351021 CET	8041	49813	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:23.953433990 CET	49813	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.953877926 CET	49813	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:23.958497047 CET	8041	49813	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.271435976 CET	8041	49812	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.271456003 CET	8041	49812	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.271514893 CET	49812	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.277115107 CET	49812	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.277523041 CET	49814	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.284099102 CET	8041	49812	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.284122944 CET	8041	49814	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.284204006 CET	49814	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.284511089 CET	49814	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.289175987 CET	8041	49814	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.597165108 CET	8041	49813	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.597246885 CET	49813	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.597489119 CET	49813	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.597517014 CET	8041	49813	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.597563982 CET	49813	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.602292061 CET	8041	49813	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.603529930 CET	49815	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.608211994 CET	8041	49815	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.608287096 CET	49815	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.608571053 CET	49815	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.613233089 CET	8041	49815	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.946175098 CET	8041	49814	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.946258068 CET	49814	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.946484089 CET	8041	49814	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.946521997 CET	49814	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.946540117 CET	49814	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.946913004 CET	49816	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.951229095 CET	8041	49814	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.951678038 CET	8041	49816	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.951757908 CET	49816	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.951874018 CET	49816	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:24.956588984 CET	8041	49816	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:24.956650972 CET	49816	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.221678019 CET	8041	49815	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:25.221812010 CET	8041	49815	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:25.221829891 CET	49815	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.221858025 CET	49815	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.222111940 CET	49815	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.225883007 CET	49817	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.226825953 CET	8041	49815	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:25.230611086 CET	8041	49817	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:25.230676889 CET	49817	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.230775118 CET	49817	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:25.235548973 CET	8041	49817	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:25.235604048 CET	49817	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.260045052 CET	49818	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.264734983 CET	8041	49818	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:26.264801979 CET	49818	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.265023947 CET	49818	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.269649982 CET	8041	49818	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:26.885732889 CET	8041	49818	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:26.885817051 CET	49818	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.885848045 CET	8041	49818	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:26.885890007 CET	49818	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.886096954 CET	49818	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.890729904 CET	8041	49818	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:26.890933037 CET	49819	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.895636082 CET	8041	49819	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:26.895739079 CET	49819	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.895987988 CET	49819	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:26.900603056 CET	8041	49819	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:27.506068945 CET	8041	49819	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:27.506172895 CET	8041	49819	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:27.506206989 CET	49819	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:27.506248951 CET	49819	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:27.506453037 CET	49819	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:27.510339975 CET	49820	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:27.511043072 CET	8041	49819	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:27.515074015 CET	8041	49820	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:27.515146017 CET	49820	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:27.515283108 CET	49820	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:27.520098925 CET	8041	49820	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:27.520149946 CET	49820	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:28.978718042 CET	49821	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:28.983484030 CET	8041	49821	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:28.984225035 CET	49821	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:28.984478951 CET	49821	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:28.989132881 CET	8041	49821	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:29.602041960 CET	8041	49821	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:29.602119923 CET	49821	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:29.602380037 CET	49821	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:29.602464914 CET	8041	49821	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:29.602509022 CET	49821	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:29.602781057 CET	49822	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:29.607558966 CET	8041	49821	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:29.608408928 CET	8041	49822	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:29.608470917 CET	49822	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:29.608635902 CET	49822	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:29.614998102 CET	8041	49822	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:30.230704069 CET	8041	49822	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:30.230772972 CET	8041	49822	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:30.230782032 CET	49822	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:30.230817080 CET	49822	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:30.231060982 CET	49822	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:30.231408119 CET	49823	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:30.236100912 CET	8041	49822	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:30.236618996 CET	8041	49823	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:30.236684084 CET	49823	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:30.236777067 CET	49823	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:30.242850065 CET	8041	49823	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:30.242892027 CET	49823	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:31.541069031 CET	49824	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:31.545862913 CET	8041	49824	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:31.545952082 CET	49824	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:31.546200037 CET	49824	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:31.550848007 CET	8041	49824	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:33.140090942 CET	8041	49824	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:33.140151978 CET	49824	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:33.235734940 CET	49824	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:33.240406036 CET	8041	49824	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:33.259047985 CET	49825	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:33.263751030 CET	8041	49825	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:33.263814926 CET	49825	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:33.264147997 CET	49825	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:33.268762112 CET	8041	49825	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.856868982 CET	8041	49825	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.856951952 CET	49825	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.857023954 CET	49825	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.858635902 CET	49826	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.861704111 CET	8041	49825	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.863306046 CET	8041	49826	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.863390923 CET	49826	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.863475084 CET	49826	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.868220091 CET	8041	49826	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.868269920 CET	8041	49826	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.868320942 CET	49826	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.895572901 CET	49827	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.901031971 CET	8041	49827	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:34.901113987 CET	49827	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.901331902 CET	49827	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:34.906534910 CET	8041	49827	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:35.259473085 CET	49828	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:35.264226913 CET	8041	49828	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:35.264301062 CET	49828	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:35.264523983 CET	49828	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:35.269151926 CET	8041	49828	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:35.912311077 CET	8041	49828	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:35.912373066 CET	49828	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:35.912463903 CET	8041	49828	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:35.912506104 CET	49828	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:35.917836905 CET	49828	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:35.923599958 CET	8041	49828	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.121362925 CET	49829	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.126380920 CET	8041	49829	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.126437902 CET	49829	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.127407074 CET	49829	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.132025957 CET	8041	49829	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.497750998 CET	8041	49827	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:36.500468016 CET	49827	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:36.500704050 CET	49827	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:36.502511024 CET	49830	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:36.505340099 CET	8041	49827	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:36.507438898 CET	8041	49830	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:36.507519960 CET	49830	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:36.507788897 CET	49830	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:36.512428045 CET	8041	49830	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:36.747766018 CET	8041	49829	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.747781038 CET	8041	49829	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.747818947 CET	49829	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.747844934 CET	49829	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.748282909 CET	49829	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.752217054 CET	49831	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.753950119 CET	8041	49829	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.758423090 CET	8041	49831	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.758543968 CET	49831	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.758737087 CET	49831	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:36.763647079 CET	8041	49831	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:36.763684988 CET	49831	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:37.794004917 CET	49832	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:37.798858881 CET	8041	49832	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:37.798933029 CET	49832	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:37.799398899 CET	49832	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:37.804013968 CET	8041	49832	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:38.109589100 CET	8041	49830	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:38.109666109 CET	49830	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:38.109991074 CET	49830	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:38.111831903 CET	49833	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:38.114665031 CET	8041	49830	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:38.116566896 CET	8041	49833	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:38.116631031 CET	49833	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:38.116794109 CET	49833	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:38.122661114 CET	8041	49833	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:38.122703075 CET	49833	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:38.439637899 CET	8041	49832	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:38.439697981 CET	49832	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:38.439913988 CET	49832	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:38.440349102 CET	8041	49832	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:38.440591097 CET	49832	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:38.444546938 CET	8041	49832	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:38.455383062 CET	49834	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:38.460149050 CET	8041	49834	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:38.460210085 CET	49834	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:38.460485935 CET	49834	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:38.465091944 CET	8041	49834	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:39.078025103 CET	8041	49834	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:39.078038931 CET	8041	49834	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:39.078075886 CET	49834	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:39.078125954 CET	49834	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:39.095319986 CET	49834	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:39.100035906 CET	8041	49834	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:39.118388891 CET	49835	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:39.124119997 CET	8041	49835	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:39.124181032 CET	49835	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:39.222718000 CET	49835	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:39.228144884 CET	8041	49835	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:39.228199005 CET	49835	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.217439890 CET	49836	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.222284079 CET	8041	49836	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:42.222351074 CET	49836	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.222743034 CET	49836	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.227379084 CET	8041	49836	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:42.299072027 CET	49837	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:42.303829908 CET	8041	49837	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:42.303888083 CET	49837	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:42.304241896 CET	49837	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:42.308839083 CET	8041	49837	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:42.834949970 CET	8041	49836	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:42.835134983 CET	49836	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.835474968 CET	8041	49836	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:42.835520029 CET	49836	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.835575104 CET	49836	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.840194941 CET	8041	49836	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:42.841626883 CET	49838	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.846375942 CET	8041	49838	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:42.846483946 CET	49838	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.846755981 CET	49838	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:42.851392984 CET	8041	49838	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.485629082 CET	8041	49838	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.485703945 CET	49838	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.485752106 CET	8041	49838	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.485806942 CET	49838	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.486133099 CET	49838	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.490797997 CET	8041	49838	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.492829084 CET	49839	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.498620987 CET	8041	49839	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.498812914 CET	49839	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.498944044 CET	49839	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.504178047 CET	8041	49839	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.504245043 CET	49839	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.541837931 CET	49840	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.546798944 CET	8041	49840	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.546886921 CET	49840	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.547213078 CET	49840	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:43.551816940 CET	8041	49840	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:43.906753063 CET	8041	49837	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:43.906806946 CET	49837	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:43.906908035 CET	49837	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:43.911571026 CET	8041	49837	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:43.914810896 CET	49841	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:43.919540882 CET	8041	49841	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:43.919610023 CET	49841	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:43.919949055 CET	49841	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:43.924622059 CET	8041	49841	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:44.208542109 CET	8041	49840	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.208556890 CET	8041	49840	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.208595037 CET	49840	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.208626986 CET	49840	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.208949089 CET	49840	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.212539911 CET	49842	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.214057922 CET	8041	49840	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.218595028 CET	8041	49842	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.218653917 CET	49842	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.218966007 CET	49842	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.225215912 CET	8041	49842	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.854985952 CET	8041	49842	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.855004072 CET	8041	49842	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.858366013 CET	49842	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.882782936 CET	49842	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.887469053 CET	8041	49842	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.934159040 CET	49843	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.938832998 CET	8041	49843	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.942214012 CET	49843	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.943171024 CET	49843	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:44.947812080 CET	8041	49843	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:44.950242043 CET	49843	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:45.536793947 CET	8041	49841	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:45.536854029 CET	49841	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:45.536906004 CET	49841	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:45.538939953 CET	49844	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:45.541604042 CET	8041	49841	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:45.543634892 CET	8041	49844	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:45.543690920 CET	49844	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:45.543885946 CET	49844	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:45.548593998 CET	8041	49844	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:45.548639059 CET	49844	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:47.963291883 CET	49845	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:47.967977047 CET	8041	49845	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:47.968046904 CET	49845	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:47.985838890 CET	49845	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:47.991548061 CET	8041	49845	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:49.384332895 CET	49846	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.389050007 CET	8041	49846	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:49.389261007 CET	49846	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.389625072 CET	49846	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.394264936 CET	8041	49846	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:49.559149027 CET	8041	49845	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:49.559201956 CET	49845	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.559293985 CET	49845	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.564090967 CET	8041	49845	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:49.569294930 CET	49847	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.574054956 CET	8041	49847	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:49.574109077 CET	49847	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.574567080 CET	49847	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:49.579602003 CET	8041	49847	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.063541889 CET	8041	49846	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.064466953 CET	49846	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.066287994 CET	49846	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.066287994 CET	49848	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.070965052 CET	8041	49846	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.070977926 CET	8041	49848	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.071137905 CET	49848	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.074173927 CET	49848	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.078825951 CET	8041	49848	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.324382067 CET	8041	49847	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.324455023 CET	49847	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.324584961 CET	49847	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.329195976 CET	8041	49847	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.329226971 CET	49849	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.333884954 CET	8041	49849	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.334002018 CET	49849	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.334146976 CET	49849	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:51.338845015 CET	8041	49849	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:51.338984966 CET	49849	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:52.691545963 CET	8041	49848	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:52.692429066 CET	49848	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:52.692491055 CET	49848	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:52.697283030 CET	8041	49848	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:52.697308064 CET	49850	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:52.702090025 CET	8041	49850	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:52.702296972 CET	49850	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:52.702387094 CET	49850	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:52.707106113 CET	8041	49850	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:52.710293055 CET	49850	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:53.400542974 CET	49851	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:53.405314922 CET	8041	49851	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:53.410264969 CET	49851	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:53.414177895 CET	49851	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:53.418802023 CET	8041	49851	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:55.000117064 CET	8041	49851	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:55.000329018 CET	49851	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:55.000525951 CET	49851	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:55.005213022 CET	8041	49851	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:55.040190935 CET	49852	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:55.044886112 CET	8041	49852	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:55.048425913 CET	49852	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:55.052237988 CET	49852	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:55.056895018 CET	8041	49852	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:55.769399881 CET	49853	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:55.774126053 CET	8041	49853	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:55.774188042 CET	49853	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:55.774588108 CET	49853	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:55.779259920 CET	8041	49853	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:56.411629915 CET	8041	49853	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:56.411686897 CET	49853	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:56.411840916 CET	8041	49853	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:56.411878109 CET	49853	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:56.412271023 CET	49853	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:56.416903019 CET	8041	49853	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:56.417063951 CET	49854	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:56.421782970 CET	8041	49854	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:56.421849966 CET	49854	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:56.422301054 CET	49854	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:56.426970005 CET	8041	49854	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:56.640784979 CET	8041	49852	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:56.644438982 CET	49852	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:56.644438982 CET	49852	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:56.648344040 CET	49855	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:56.649156094 CET	8041	49852	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:56.653057098 CET	8041	49855	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:56.656482935 CET	49855	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:56.656482935 CET	49855	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:56.661444902 CET	8041	49855	82.115.223.39	192.168.2.4
Mar 13, 2025 13:47:56.664351940 CET	49855	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:47:57.086425066 CET	8041	49854	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:57.086437941 CET	8041	49854	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:57.086539030 CET	49854	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:57.086858988 CET	49854	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:57.091473103 CET	8041	49854	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:57.102068901 CET	49856	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:57.106817007 CET	8041	49856	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:57.106981993 CET	49856	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:57.107219934 CET	49856	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:47:57.111979008 CET	8041	49856	80.78.24.30	192.168.2.4
Mar 13, 2025 13:47:57.112320900 CET	49856	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.170874119 CET	49857	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.175654888 CET	8041	49857	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:00.175719976 CET	49857	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.176076889 CET	49857	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.180757999 CET	8041	49857	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:00.799778938 CET	8041	49857	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:00.799854994 CET	8041	49857	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:00.802270889 CET	49857	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.802614927 CET	49857	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.807269096 CET	8041	49857	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:00.810194969 CET	49858	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.814851999 CET	8041	49858	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:00.818269968 CET	49858	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.818542957 CET	49858	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:00.823198080 CET	8041	49858	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.460134029 CET	8041	49858	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.460237026 CET	8041	49858	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.460356951 CET	49858	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.460762978 CET	49858	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.465401888 CET	8041	49858	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.475745916 CET	49859	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.480468035 CET	8041	49859	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.480580091 CET	49859	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.480684996 CET	49859	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.485455990 CET	8041	49859	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.485631943 CET	49859	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.765883923 CET	49860	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.773281097 CET	8041	49860	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:01.773355961 CET	49860	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.773792028 CET	49860	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:01.781676054 CET	8041	49860	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:02.388648987 CET	8041	49860	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:02.388700008 CET	49860	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:02.388715029 CET	8041	49860	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:02.388782978 CET	49860	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:02.388988972 CET	49860	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:02.392163992 CET	49861	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:02.393593073 CET	8041	49860	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:02.396850109 CET	8041	49861	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:02.396903992 CET	49861	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:02.397264004 CET	49861	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:02.401913881 CET	8041	49861	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:03.012052059 CET	8041	49861	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:03.012279987 CET	8041	49861	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:03.014236927 CET	49861	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:03.086172104 CET	49861	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:03.086653948 CET	49862	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:03.090938091 CET	8041	49861	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:03.091365099 CET	8041	49862	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:03.098210096 CET	49862	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:03.100049019 CET	49862	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:03.104784966 CET	8041	49862	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:03.104962111 CET	49862	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:06.544152975 CET	49863	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:06.548882008 CET	8041	49863	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:06.548945904 CET	49863	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:06.549269915 CET	49863	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:06.553898096 CET	8041	49863	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.159759045 CET	8041	49863	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.159813881 CET	8041	49863	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.159841061 CET	49863	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.160121918 CET	49863	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.160161018 CET	49863	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.164798975 CET	8041	49863	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.168415070 CET	49864	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.173110962 CET	8041	49864	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.173245907 CET	49864	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.173584938 CET	49864	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.179063082 CET	8041	49864	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.794425964 CET	8041	49864	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.794445038 CET	8041	49864	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.794480085 CET	49864	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.794524908 CET	49864	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.794843912 CET	49864	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.799359083 CET	49865	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.799454927 CET	8041	49864	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.804058075 CET	8041	49865	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.804122925 CET	49865	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.804234982 CET	49865	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:07.808936119 CET	8041	49865	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:07.808981895 CET	49865	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.184324026 CET	49866	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.189075947 CET	8041	49866	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:08.189133883 CET	49866	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.189517021 CET	49866	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.194144964 CET	8041	49866	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:08.807909966 CET	8041	49866	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:08.808114052 CET	8041	49866	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:08.808223963 CET	49866	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.808505058 CET	49866	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.813127041 CET	8041	49866	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:08.829808950 CET	49867	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.834537029 CET	8041	49867	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:08.836605072 CET	49867	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.836605072 CET	49867	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:08.841310978 CET	8041	49867	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:09.463888884 CET	8041	49867	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:09.464016914 CET	8041	49867	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:09.464229107 CET	49867	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:09.468271017 CET	49867	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:09.468274117 CET	49868	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:09.472949028 CET	8041	49867	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:09.472971916 CET	8041	49868	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:09.476496935 CET	49868	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:09.476496935 CET	49868	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:09.481368065 CET	8041	49868	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:09.481499910 CET	49868	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:12.862217903 CET	49869	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:12.867002964 CET	8041	49869	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:12.867249012 CET	49869	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:12.870230913 CET	49869	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:12.874905109 CET	8041	49869	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.543503046 CET	8041	49869	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.543608904 CET	8041	49869	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.546580076 CET	49869	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.546581030 CET	49869	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.551295996 CET	8041	49869	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.570230007 CET	49870	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.575072050 CET	8041	49870	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.578422070 CET	49870	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.578780890 CET	49870	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.583496094 CET	8041	49870	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.588378906 CET	49871	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.593034029 CET	8041	49871	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:13.593085051 CET	49871	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.593365908 CET	49871	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:13.598026037 CET	8041	49871	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.219115019 CET	8041	49870	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.219136953 CET	8041	49870	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.219166040 CET	49870	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.219196081 CET	49870	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.219583988 CET	49870	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.223709106 CET	49872	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.224303007 CET	8041	49870	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.224467993 CET	8041	49871	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.224519014 CET	49871	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.224684000 CET	8041	49871	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.224728107 CET	49871	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.224746943 CET	49871	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.225042105 CET	49873	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.228399992 CET	8041	49872	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.228462934 CET	49872	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.228624105 CET	49872	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.229360104 CET	8041	49871	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.229671001 CET	8041	49873	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.229727983 CET	49873	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.229979038 CET	49873	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.233279943 CET	8041	49872	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.233333111 CET	49872	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.234577894 CET	8041	49873	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.640357971 CET	49874	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:14.645107985 CET	8041	49874	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:14.648385048 CET	49874	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:14.652360916 CET	49874	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:14.657094002 CET	8041	49874	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:14.857439041 CET	8041	49873	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.857577085 CET	49873	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.857579947 CET	8041	49873	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.857635021 CET	49873	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.858030081 CET	49873	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.858582973 CET	49875	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.862699986 CET	8041	49873	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.863265991 CET	8041	49875	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.866354942 CET	49875	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.866584063 CET	49875	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:14.871293068 CET	8041	49875	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:14.872195005 CET	49875	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:16.231699944 CET	8041	49874	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:16.231751919 CET	49874	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:16.231839895 CET	49874	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:16.234029055 CET	49876	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:16.240047932 CET	8041	49874	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:16.240061045 CET	8041	49876	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:16.240128040 CET	49876	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:16.240494967 CET	49876	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:16.245138884 CET	8041	49876	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:17.828711033 CET	8041	49876	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:17.828783989 CET	49876	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:17.828958988 CET	49876	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:17.831008911 CET	49877	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:17.833602905 CET	8041	49876	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:17.835728884 CET	8041	49877	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:17.835807085 CET	49877	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:17.835953951 CET	49877	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:17.840653896 CET	8041	49877	82.115.223.39	192.168.2.4
Mar 13, 2025 13:48:17.840692997 CET	49877	8041	192.168.2.4	82.115.223.39
Mar 13, 2025 13:48:19.889918089 CET	49878	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:19.894656897 CET	8041	49878	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:19.894720078 CET	49878	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:19.895092010 CET	49878	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:19.899736881 CET	8041	49878	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:19.918767929 CET	49879	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:19.923515081 CET	8041	49879	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:19.923574924 CET	49879	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:19.923894882 CET	49879	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:19.928579092 CET	8041	49879	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.516231060 CET	8041	49878	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.516292095 CET	49878	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.516670942 CET	8041	49878	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.516711950 CET	49878	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.516730070 CET	49878	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.521075010 CET	49880	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.522267103 CET	8041	49878	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.525767088 CET	8041	49880	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.525820971 CET	49880	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.526236057 CET	49880	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.530905008 CET	8041	49880	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.553906918 CET	8041	49879	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.554054976 CET	49879	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.554115057 CET	8041	49879	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.554156065 CET	49879	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.554275036 CET	49879	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.558414936 CET	49881	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.558887005 CET	8041	49879	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.563080072 CET	8041	49881	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:20.563133001 CET	49881	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.563467026 CET	49881	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:20.568129063 CET	8041	49881	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.149693966 CET	8041	49880	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.149874926 CET	8041	49880	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.154808044 CET	49880	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.154808044 CET	49880	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.159571886 CET	8041	49880	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.162229061 CET	49882	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.166975021 CET	8041	49882	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.167346001 CET	49882	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.167567968 CET	49882	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.172389030 CET	8041	49882	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.172946930 CET	49882	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.210896015 CET	8041	49881	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.211030960 CET	49881	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.211075068 CET	8041	49881	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.211272955 CET	49881	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.213263035 CET	49881	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.217905998 CET	8041	49881	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.218183994 CET	49883	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.222903967 CET	8041	49883	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.223053932 CET	49883	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.223310947 CET	49883	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.227992058 CET	8041	49883	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.228091002 CET	49883	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.282728910 CET	49884	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.287386894 CET	8041	49884	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.287487030 CET	49884	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.287770987 CET	49884	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.292377949 CET	8041	49884	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.899288893 CET	8041	49884	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.899349928 CET	49884	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.899444103 CET	8041	49884	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.899486065 CET	49884	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.903207064 CET	49884	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.907924891 CET	8041	49884	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.907944918 CET	49885	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.912638903 CET	8041	49885	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:21.912698984 CET	49885	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.913060904 CET	49885	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:21.917687893 CET	8041	49885	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:22.559988976 CET	8041	49885	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:22.560045004 CET	49885	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:22.560081959 CET	8041	49885	80.78.24.30	192.168.2.4
Mar 13, 2025 13:48:22.560128927 CET	49885	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:22.560652018 CET	49885	8041	192.168.2.4	80.78.24.30
Mar 13, 2025 13:48:22.565279007 CET	8041	49885	80.78.24.30	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 13:46:22.472079992 CET	49409	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:46:22.496952057 CET	53	49409	1.1.1.1	192.168.2.4
Mar 13, 2025 13:46:25.642887115 CET	50194	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:46:25.666907072 CET	53	50194	1.1.1.1	192.168.2.4
Mar 13, 2025 13:46:25.820317984 CET	62547	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:46:26.141036034 CET	53	62547	1.1.1.1	192.168.2.4
Mar 13, 2025 13:46:29.040390968 CET	62385	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:46:29.388737917 CET	53	62385	1.1.1.1	192.168.2.4
Mar 13, 2025 13:47:47.609471083 CET	53836	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:47:47.941808939 CET	53	53836	1.1.1.1	192.168.2.4
Mar 13, 2025 13:47:49.018167973 CET	62852	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:47:49.383487940 CET	53	62852	1.1.1.1	192.168.2.4
Mar 13, 2025 13:48:14.268102884 CET	53275	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:48:14.635371923 CET	53	53275	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 13:46:22.472079992 CET	192.168.2.4	1.1.1.1	0x572d	Standard query (0)	tiguanin.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:46:25.642887115 CET	192.168.2.4	1.1.1.1	0xaeee	Standard query (0)	bazarunet.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:46:25.820317984 CET	192.168.2.4	1.1.1.1	0x51bf	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:46:29.040390968 CET	192.168.2.4	1.1.1.1	0x297a	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:47:47.609471083 CET	192.168.2.4	1.1.1.1	0x3e86	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:47:49.018167973 CET	192.168.2.4	1.1.1.1	0xfbd8	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:48:14.268102884 CET	192.168.2.4	1.1.1.1	0xed67	Standard query (0)	greshunka.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 13:46:22.496952057 CET	1.1.1.1	192.168.2.4	0x572d	No error (0)	tiguanin.com	80.78.24.30	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:46:25.666907072 CET	1.1.1.1	192.168.2.4	0xaeee	No error (0)	bazarunet.com	80.78.24.30	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:46:26.141036034 CET	1.1.1.1	192.168.2.4	0x51bf	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:46:29.388737917 CET	1.1.1.1	192.168.2.4	0x297a	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:47:47.941808939 CET	1.1.1.1	192.168.2.4	0x3e86	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:47:49.383487940 CET	1.1.1.1	192.168.2.4	0xfbd8	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:48:14.635371923 CET	1.1.1.1	192.168.2.4	0xed67	No error (0)	greshunka.com	82.115.223.39	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49724	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:23.121745110 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49726	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:23.751617908 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49729	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:26.302337885 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:26.952316046 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:33.079308033 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:33.705588102 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:35.385831118 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:35.530623913 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:36.003824949 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:36.153944969 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:39.829086065 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49755	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:40.017576933 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49756	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:40.459273100 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49757	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:40.673372030 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49760	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:41.560395956 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49761	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:42.178523064 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:52.097517967 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49770	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:52.721174002 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49772	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:53.427469969 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:53.700427055 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49774	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:54.062762022 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49775	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:54.370870113 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49778	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:55.771673918 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49779	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:46:56.395648956 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49781	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:00.112761021 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49782	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:00.758647919 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49784	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:01.530878067 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49785	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:02.182517052 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49792	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:10.647814035 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49794	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:11.302711010 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49795	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:11.320375919 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49798	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:11.935664892 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49800	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:14.980206966 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49801	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:15.615822077 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49803	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:16.620476961 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49804	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:17.268069983 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49806	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:19.953242064 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49807	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:20.592772961 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49809	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:21.288511038 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49810	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:21.917766094 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49812	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:24.271435976 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49813	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:24.597165108 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49814	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:24.946175098 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49815	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:25.221678019 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49818	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:26.885732889 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49819	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:27.506068945 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49821	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:29.602041960 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49822	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:30.230704069 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49828	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:35.912311077 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49829	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:36.747766018 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49832	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:38.439637899 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49834	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:39.078025103 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49836	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:42.834949970 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49838	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:43.485629082 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49840	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:44.208542109 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49842	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:44.854985952 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49853	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:56.411629915 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49854	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:47:57.086425066 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49857	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:00.799778938 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49858	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:01.460134029 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49860	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:02.388648987 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49861	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:03.012052059 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49863	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:07.159759045 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49864	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:07.794425964 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49866	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:08.807909966 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49867	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:09.463888884 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49869	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:13.543503046 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49870	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:14.219115019 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49871	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:14.224467993 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49873	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:14.857439041 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49878	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:20.516231060 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49879	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:20.553906918 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49880	80.78.24.30	8041	7596	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:21.149693966 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49881	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:21.210896015 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49884	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:21.899288893 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49885	80.78.24.30	8041	8156	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:48:22.559988976 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Target ID:	0
Start time:	08:46:15
Start date:	13/03/2025
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll"
Imagebase:	0x7ff60d7f0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1219643944.000002321C782000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:46:15
Start date:	13/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:46:15
Start date:	13/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1
Imagebase:	0x7ff6aae60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:46:15
Start date:	13/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,DllMain
Imagebase:	0x7ff721970000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:46:15
Start date:	13/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",#1
Imagebase:	0x7ff721970000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:46:18
Start date:	13/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll,StartW
Imagebase:	0x7ff721970000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_2, Description: Yara detected BruteRatel, Source: 00000005.00000002.2422008141.0000022FBF16F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000003.1188708860.0000022FC0D25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:46:21
Start date:	13/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",DllMain
Imagebase:	0x7ff721970000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:46:21
Start date:	13/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\badger_x64_stealth_rtl.bin.dll.dll",StartW
Imagebase:	0x7ff721970000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.1219889188.0000026626356000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report badger_x64_stealth_rtl.bin.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Packets

Statistics

Windows Analysis Report
badger_x64_stealth_rtl.bin.dll.dll